style: satisfy golangci-lint on the round-6 changes

nolintlint: gosec was not firing on the deferred Close.
nonamedreturns + varnamelen in collapseUserModeOps.

Dockerfile

@@ -53,7 +53,7 @@ RUN apk add --no-cache ca-certificates \
 COPY --from=builder /neoircd /usr/local/bin/neoircd
 
 USER neoirc
-EXPOSE 8080
+EXPOSE 8080 6667
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD wget -qO- http://localhost:8080/.well-known/healthcheck.json || exit 1
 ENTRYPOINT ["neoircd"]

README.md

@@ -1080,8 +1080,8 @@ the server to the client (never C2S) and use 3-digit string codes in the
 | `001` | RPL_WELCOME         | After session creation | `{"command":"001","to":"alice","body":["Welcome to the network, alice"]}` |
 | `002` | RPL_YOURHOST        | After session creation | `{"command":"002","to":"alice","body":["Your host is neoirc, running version 0.1"]}` |
 | `003` | RPL_CREATED         | After session creation | `{"command":"003","to":"alice","body":["This server was created 2026-02-10"]}` |
-| `004` | RPL_MYINFO          | After session creation | `{"command":"004","to":"alice","params":["neoirc","0.1","","mnst"]}` |
+| `004` | RPL_MYINFO          | After session creation | `{"command":"004","to":"alice","params":["neoirc","0.1","","ikmnostl"]}` |
-| `005` | RPL_ISUPPORT        | After session creation | `{"command":"005","to":"alice","params":["CHANTYPES=#","NICKLEN=32","PREFIX=(ov)@+","CHANMODES=,,H,mnst","NETWORK=neoirc"],"body":["are supported by this server"]}` |
+| `005` | RPL_ISUPPORT        | After session creation | `{"command":"005","to":"alice","params":["CHANTYPES=#","NICKLEN=32","PREFIX=(ov)@+","CHANMODES=b,k,Hl,imnst","NETWORK=neoirc"],"body":["are supported by this server"]}` |
 | `221` | RPL_UMODEIS         | In response to user MODE query | `{"command":"221","to":"alice","body":["+"]}` |
 | `251` | RPL_LUSERCLIENT     | On connect or LUSERS command | `{"command":"251","to":"alice","body":["There are 5 users and 0 invisible on 1 servers"]}` |
 | `252` | RPL_LUSEROP         | On connect or LUSERS command | `{"command":"252","to":"alice","params":["0"],"body":["operator(s) online"]}` |
@@ -1129,12 +1129,15 @@ Inspired by IRC, simplified:
 
 | Mode | Name           | Meaning | Status |
 |------|----------------|---------|--------|
+| `+b` | Ban            | Prevents matching hostmasks from joining or sending (parameter: `nick!user@host` mask with wildcards) | **Enforced** |
+| `+i` | Invite-only    | Only invited users can join; use `INVITE nick #channel` to invite | **Enforced** |
+| `+k` | Channel key    | Requires a password to join (parameter: key string) | **Enforced** |
+| `+l` | User limit     | Maximum number of members allowed in the channel (parameter: integer) | **Enforced** |
 | `+m` | Moderated      | Only voiced (`+v`) users and operators (`+o`) can send | **Enforced** |
-| `+t` | Topic lock     | Only operators can change the topic (default: ON) | **Enforced** |
 | `+n` | No external    | Only channel members can send messages to the channel | **Enforced** |
+| `+s` | Secret         | Channel hidden from LIST and WHOIS for non-members | **Enforced** |
+| `+t` | Topic lock     | Only operators can change the topic (default: ON) | **Enforced** |
 | `+H` | Hashcash       | Requires proof-of-work for PRIVMSG (parameter: bits, e.g. `+H 20`) | **Enforced** |
-| `+i` | Invite-only    | Only invited users can join | Not yet enforced |
-| `+s` | Secret         | Channel hidden from LIST response | Not yet enforced |
 
 **User channel modes (set per-user per-channel):**
 
@@ -1146,6 +1149,42 @@ Inspired by IRC, simplified:
 **Channel creator auto-op:** The first user to JOIN a channel (creating it)
 automatically receives `+o` operator status.
 
+**Ban system (+b):** Operators can ban users by hostmask pattern with wildcard
+matching (`*` and `?`). `MODE #channel +b` with no argument lists current bans.
+Bans prevent both joining and sending messages.
+
+```
+MODE #channel +b *!*@*.example.com   — ban all users from example.com
+MODE #channel -b *!*@*.example.com   — remove the ban
+MODE #channel +b                     — list all bans (RPL_BANLIST 367/368)
+```
+
+**Invite-only (+i):** When set, users must be invited by an operator before
+joining. The `INVITE` command records an invite that is consumed on JOIN.
+
+```
+MODE #channel +i                     — set invite-only
+INVITE nick #channel                 — invite a user (operator only on +i channels)
+```
+
+**Channel key (+k):** Requires a password to join the channel.
+
+```
+MODE #channel +k secretpass          — set a channel key
+MODE #channel -k *                   — remove the key
+JOIN #channel secretpass             — join with key
+```
+
+**User limit (+l):** Caps the number of members in the channel.
+
+```
+MODE #channel +l 50                  — set limit to 50 members
+MODE #channel -l                     — remove the limit
+```
+
+**Secret (+s):** Hides the channel from `LIST` for non-members and from
+`WHOIS` channel lists when the querier is not in the same channel.
+
 **KICK command:** Channel operators can remove users with `KICK #channel nick
 [:reason]`. The kicked user and all channel members receive the KICK message.
 
@@ -1154,7 +1193,7 @@ RPL_AWAY), and skips hashcash validation on +H channels (servers and services
 use NOTICE).
 
 **ISUPPORT:** The server advertises `PREFIX=(ov)@+` and
-`CHANMODES=,,H,mnst` in RPL_ISUPPORT (005).
+`CHANMODES=b,k,Hl,imnst` in RPL_ISUPPORT (005).
 
 ### Per-Channel Hashcash (Anti-Spam)
 
@@ -2228,7 +2267,7 @@ directory is also loaded automatically via
 | `NEOIRC_OPER_PASSWORD` | string | `""`                              | Server operator (o-line) password. Both name and password must be set to enable OPER. |
 | `LOGIN_RATE_LIMIT` | float   | `1`                                  | Allowed login attempts per second per IP address. |
 | `LOGIN_RATE_BURST`  | int    | `5`                                  | Maximum burst of login attempts per IP before rate limiting kicks in. |
-| `IRC_LISTEN_ADDR`  | string  | `":6667"`                            | TCP address for the traditional IRC protocol listener. Set empty to disable. |
+| `IRC_LISTEN_ADDR`  | string  | `:6667`                              | TCP address for the traditional IRC protocol listener. Set to empty string to disable. |
 | `MAINTENANCE_MODE` | bool    | `false`                              | Maintenance mode flag (reserved) |
 
 ### Example `.env` file
@@ -2252,17 +2291,15 @@ neoirc includes an optional traditional IRC wire protocol listener (RFC
 backward compatibility with existing IRC clients like irssi, weechat, hexchat,
 and others.
 
-### Enabling
+### Configuration
 
-Set the `IRC_LISTEN_ADDR` environment variable to a TCP address:
+The IRC listener is **enabled by default** on `:6667`. To disable it, set
+`IRC_LISTEN_ADDR` to an empty string:
 
 ```bash
-IRC_LISTEN_ADDR=:6667
+IRC_LISTEN_ADDR=
 ```
 
-When unset or empty, the IRC listener is disabled and only the HTTP/JSON API is
-available.
-
 ### Supported Commands
 
 | Category   | Commands                                             |
@@ -2270,8 +2307,8 @@ available.
 | Connection | `NICK`, `USER`, `PASS`, `QUIT`, `PING`/`PONG`, `CAP` |
 | Channels   | `JOIN`, `PART`, `MODE`, `TOPIC`, `NAMES`, `LIST`, `KICK`, `INVITE` |
 | Messaging  | `PRIVMSG`, `NOTICE`                                  |
-| Info       | `WHO`, `WHOIS`, `LUSERS`, `MOTD`, `AWAY`             |
+| Info       | `WHO`, `WHOIS`, `LUSERS`, `MOTD`, `AWAY`, `USERHOST`, `VERSION`, `ADMIN`, `INFO`, `TIME` |
-| Operator   | `OPER` (requires `NEOIRC_OPER_NAME` and `NEOIRC_OPER_PASSWORD`) |
+| Operator   | `OPER`, `KILL`, `WALLOPS` (requires `NEOIRC_OPER_NAME` and `NEOIRC_OPER_PASSWORD`) |
 
 ### Protocol Details
 
@@ -2287,6 +2324,15 @@ available.
   operator status (`@`).
 - **Channel modes**: `+m` (moderated), `+t` (topic lock), `+o` (operator),
   `+v` (voice)
+- **User modes**: `+o` (operator, set only via `OPER`), `+w` (receives
+  `WALLOPS`). `MODE` for any nick other than your own is rejected with
+  `ERR_USERSDONTMATCH` (502), for both queries and changes. Nick comparison
+  is case-insensitive.
+- **KILL**: an operator's `KILL` broadcasts the victim's `QUIT` to its channel
+  peers, deletes its session, and then sends the victim a `KILL` and
+  `ERROR :Closing Link` before closing its socket. This applies to victims on
+  the IRC listener regardless of whether the `KILL` arrived over IRC or the
+  HTTP API.
 
 ### Bridge to HTTP API
 
@@ -2297,13 +2343,13 @@ connected via the HTTP API can communicate in the same channels seamlessly.
 
 ### Docker Usage
 
-To expose the IRC port in Docker:
+To expose the IRC port in Docker (the listener is enabled by default on
+`:6667`):
 
 ```bash
 docker run -d \
   -p 8080:8080 \
   -p 6667:6667 \
-  -e IRC_LISTEN_ADDR=:6667 \
   -v neoirc-data:/var/lib/neoirc \
   neoirc
 ```
@@ -2762,7 +2808,7 @@ guess is borne by the server (bcrypt), not the client.
 - [x] **Client output queue pruning** — delete old client output queue entries per `QUEUE_MAX_AGE`
 - [x] **Message rotation** — prune messages older than `MESSAGE_MAX_AGE`
 - [x] **Channel modes** — enforce `+m` (moderated), `+t` (topic lock), `+n` (no external)
-- [ ] **Channel modes (tier 2)** — enforce `+i` (invite-only), `+s` (secret), `+b` (ban), `+k` (key), `+l` (limit)
+- [x] **Channel modes (tier 2)** — enforce `+i` (invite-only), `+s` (secret), `+b` (ban), `+k` (key), `+l` (limit)
 - [x] **User channel modes** — `+o` (operator), `+v` (voice) with NAMES prefixes
 - [x] **KICK command** — operator-only channel kick with broadcast
 - [x] **MODE command** — query and set channel/user modes
@@ -2783,6 +2829,10 @@ guess is borne by the server (bcrypt), not the client.
   login from additional devices via `POST /api/v1/login`
 - [x] **Cookie-based auth** — HttpOnly cookies replace Bearer tokens for
   all API authentication
+- [x] **Tier 3 utility commands** — USERHOST (302), VERSION (351), ADMIN
+  (256–259), INFO (371/374), TIME (391), KILL (oper-only forced
+  disconnect), WALLOPS (oper-only broadcast to +w users)
+- [x] **User mode +w** — wallops usermode via `MODE nick +w/-w`
 
 ### Future (1.0+)
 

cmd/neoirc-cli/main.go

@@ -1,7 +1,7 @@
 // Package main is the entry point for the neoirc-cli client.
 package main
 
-import "git.eeqj.de/sneak/neoirc/internal/cli"
+import "sneak.berlin/go/neoirc/internal/cli"
 
 func main() {
 	cli.Run()

cmd/neoircd/main.go

@@ -2,18 +2,19 @@
 package main
 
 import (
-	"git.eeqj.de/sneak/neoirc/internal/broker"
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/handlers"
-	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
-	"git.eeqj.de/sneak/neoirc/internal/ircserver"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
-	"git.eeqj.de/sneak/neoirc/internal/middleware"
-	"git.eeqj.de/sneak/neoirc/internal/server"
-	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/handlers"
+	"sneak.berlin/go/neoirc/internal/healthcheck"
+	"sneak.berlin/go/neoirc/internal/ircserver"
+	"sneak.berlin/go/neoirc/internal/logger"
+	"sneak.berlin/go/neoirc/internal/middleware"
+	"sneak.berlin/go/neoirc/internal/server"
+	"sneak.berlin/go/neoirc/internal/service"
+	"sneak.berlin/go/neoirc/internal/stats"
 )
 
 var (
@@ -40,6 +41,7 @@ func main() {
 			server.New,
 			middleware.New,
 			healthcheck.New,
+			service.New,
 			stats.New,
 		),
 		fx.Invoke(func(

go.mod

@@ -1,4 +1,4 @@
-module git.eeqj.de/sneak/neoirc
+module sneak.berlin/go/neoirc
 
 go 1.24.0
 

internal/broker/broker_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/broker"
 )
 
 func TestNewBroker(t *testing.T) {

internal/cli/api/client.go

@@ -15,7 +15,7 @@ import (
 	"strings"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/pkg/irc"
+	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 const (

internal/cli/api/hashcash.go

@@ -8,7 +8,7 @@ import (
 	"math/big"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/hashcash"
+	"sneak.berlin/go/neoirc/internal/hashcash"
 )
 
 const (

internal/cli/app.go

@@ -8,8 +8,8 @@ import (
 	"sync"
 	"time"
 
-	api "git.eeqj.de/sneak/neoirc/internal/cli/api"
+	api "sneak.berlin/go/neoirc/internal/cli/api"
-	"git.eeqj.de/sneak/neoirc/pkg/irc"
+	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 const (

internal/config/config.go

@@ -5,10 +5,10 @@ import (
 	"errors"
 	"log/slog"
 
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"github.com/spf13/viper"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/logger"
 
 	_ "github.com/joho/godotenv/autoload" // loads .env file
 )

internal/db/db.go

@@ -12,9 +12,9 @@ import (
 	"strconv"
 	"strings"
 
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/logger"
 
 	_ "github.com/joho/godotenv/autoload" // .env
 	_ "modernc.org/sqlite"                // driver
@@ -135,13 +135,21 @@ type migration struct {
 func (database *Database) runMigrations(
 	ctx context.Context,
 ) error {
-	_, err := database.conn.ExecContext(ctx,
+	bootstrap, err := SchemaFiles.ReadFile(
-		`CREATE TABLE IF NOT EXISTS schema_migrations (
+		"schema/000.sql",
-		 version INTEGER PRIMARY KEY,
+	)
-		 applied_at DATETIME DEFAULT CURRENT_TIMESTAMP)`)
 	if err != nil {
 		return fmt.Errorf(
-			"create schema_migrations: %w", err,
+			"read bootstrap migration: %w", err,
+		)
+	}
+
+	_, err = database.conn.ExecContext(
+		ctx, string(bootstrap),
+	)
+	if err != nil {
+		return fmt.Errorf(
+			"execute bootstrap migration: %w", err,
 		)
 	}
 
@@ -270,6 +278,11 @@ func (database *Database) loadMigrations() (
 			continue
 		}
 
+		// Skip bootstrap migration; it is executed separately.
+		if version == 0 {
+			continue
+		}
+
 		content, readErr := SchemaFiles.ReadFile(
 			"schema/" + entry.Name(),
 		)

internal/db/export_test.go

@@ -58,3 +58,19 @@ func (database *Database) Close() error {
 
 	return nil
 }
+
+// ExecForTest runs a raw statement against the test
+// database.  Tests use it to install SQLite triggers that
+// force a specific write to fail, so that the atomicity of
+// multi-statement helpers can be exercised.
+func (database *Database) ExecForTest(
+	ctx context.Context,
+	query string,
+) error {
+	_, err := database.conn.ExecContext(ctx, query)
+	if err != nil {
+		return fmt.Errorf("exec for test: %w", err)
+	}
+
+	return nil
+}

internal/db/main_test.go

@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"git.eeqj.de/sneak/neoirc/internal/db"
 	"golang.org/x/crypto/bcrypt"
+	"sneak.berlin/go/neoirc/internal/db"
 )
 
 func TestMain(m *testing.M) {

internal/db/queries.go

@@ -7,12 +7,14 @@ import (
 	"database/sql"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strconv"
+	"strings"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/pkg/irc"
 	"github.com/google/uuid"
+	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 const (
@@ -1835,3 +1837,782 @@ func (database *Database) PruneSpentHashcash(
 
 	return deleted, nil
 }
+
+// --- Tier 2: Ban system (+b) ---
+
+// BanInfo represents a channel ban entry.
+type BanInfo struct {
+	Mask      string
+	SetBy     string
+	CreatedAt time.Time
+}
+
+// AddChannelBan inserts a ban mask for a channel.
+func (database *Database) AddChannelBan(
+	ctx context.Context,
+	channelID int64,
+	mask, setBy string,
+) error {
+	_, err := database.conn.ExecContext(ctx,
+		`INSERT OR IGNORE INTO channel_bans
+		 (channel_id, mask, set_by, created_at)
+		 VALUES (?, ?, ?, ?)`,
+		channelID, mask, setBy, time.Now())
+	if err != nil {
+		return fmt.Errorf("add channel ban: %w", err)
+	}
+
+	return nil
+}
+
+// RemoveChannelBan removes a ban mask from a channel.
+func (database *Database) RemoveChannelBan(
+	ctx context.Context,
+	channelID int64,
+	mask string,
+) error {
+	_, err := database.conn.ExecContext(ctx,
+		`DELETE FROM channel_bans
+		 WHERE channel_id = ? AND mask = ?`,
+		channelID, mask)
+	if err != nil {
+		return fmt.Errorf("remove channel ban: %w", err)
+	}
+
+	return nil
+}
+
+// ListChannelBans returns all bans for a channel.
+//
+//nolint:dupl // different query+type vs filtered variant
+func (database *Database) ListChannelBans(
+	ctx context.Context,
+	channelID int64,
+) ([]BanInfo, error) {
+	rows, err := database.conn.QueryContext(ctx,
+		`SELECT mask, set_by, created_at
+		 FROM channel_bans
+		 WHERE channel_id = ?
+		 ORDER BY created_at ASC`,
+		channelID)
+	if err != nil {
+		return nil, fmt.Errorf("list channel bans: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var bans []BanInfo
+
+	for rows.Next() {
+		var ban BanInfo
+
+		if scanErr := rows.Scan(
+			&ban.Mask, &ban.SetBy, &ban.CreatedAt,
+		); scanErr != nil {
+			return nil, fmt.Errorf(
+				"scan channel ban: %w", scanErr,
+			)
+		}
+
+		bans = append(bans, ban)
+	}
+
+	if rowErr := rows.Err(); rowErr != nil {
+		return nil, fmt.Errorf(
+			"iterate channel bans: %w", rowErr,
+		)
+	}
+
+	return bans, nil
+}
+
+// IsSessionBanned checks if a session's hostmask matches
+// any ban in the channel. Returns true if banned.
+func (database *Database) IsSessionBanned(
+	ctx context.Context,
+	channelID, sessionID int64,
+) (bool, error) {
+	// Get the session's hostmask parts.
+	var nick, username, hostname string
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT nick, username, hostname
+		 FROM sessions WHERE id = ?`,
+		sessionID,
+	).Scan(&nick, &username, &hostname)
+	if err != nil {
+		return false, fmt.Errorf(
+			"get session hostmask: %w", err,
+		)
+	}
+
+	hostmask := FormatHostmask(nick, username, hostname)
+
+	// Get all ban masks for the channel.
+	bans, banErr := database.ListChannelBans(ctx, channelID)
+	if banErr != nil {
+		return false, banErr
+	}
+
+	for _, ban := range bans {
+		if MatchBanMask(ban.Mask, hostmask) {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+// MatchBanMask checks if hostmask matches a ban pattern
+// using IRC-style wildcard matching (* and ?).
+func MatchBanMask(pattern, hostmask string) bool {
+	return wildcardMatch(
+		strings.ToLower(pattern),
+		strings.ToLower(hostmask),
+	)
+}
+
+// wildcardMatch implements simple glob-style matching
+// with * (any sequence) and ? (any single character).
+func wildcardMatch(pattern, str string) bool {
+	for len(pattern) > 0 {
+		switch pattern[0] {
+		case '*':
+			// Skip consecutive asterisks.
+			for len(pattern) > 0 && pattern[0] == '*' {
+				pattern = pattern[1:]
+			}
+
+			if len(pattern) == 0 {
+				return true
+			}
+
+			for i := 0; i <= len(str); i++ {
+				if wildcardMatch(pattern, str[i:]) {
+					return true
+				}
+			}
+
+			return false
+		case '?':
+			if len(str) == 0 {
+				return false
+			}
+
+			pattern = pattern[1:]
+			str = str[1:]
+		default:
+			if len(str) == 0 || pattern[0] != str[0] {
+				return false
+			}
+
+			pattern = pattern[1:]
+			str = str[1:]
+		}
+	}
+
+	return len(str) == 0
+}
+
+// --- Tier 2: Invite-only (+i) ---
+
+// IsChannelInviteOnly checks if a channel has +i mode.
+func (database *Database) IsChannelInviteOnly(
+	ctx context.Context,
+	channelID int64,
+) (bool, error) {
+	var isInviteOnly int
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT is_invite_only FROM channels
+		 WHERE id = ?`,
+		channelID,
+	).Scan(&isInviteOnly)
+	if err != nil {
+		return false, fmt.Errorf(
+			"check invite only: %w", err,
+		)
+	}
+
+	return isInviteOnly != 0, nil
+}
+
+// SetChannelInviteOnly sets or unsets +i mode.
+func (database *Database) SetChannelInviteOnly(
+	ctx context.Context,
+	channelID int64,
+	inviteOnly bool,
+) error {
+	val := 0
+	if inviteOnly {
+		val = 1
+	}
+
+	_, err := database.conn.ExecContext(ctx,
+		`UPDATE channels
+		 SET is_invite_only = ?, updated_at = ?
+		 WHERE id = ?`,
+		val, time.Now(), channelID)
+	if err != nil {
+		return fmt.Errorf(
+			"set invite only: %w", err,
+		)
+	}
+
+	return nil
+}
+
+// AddChannelInvite records that a session has been
+// invited to a channel.
+func (database *Database) AddChannelInvite(
+	ctx context.Context,
+	channelID, sessionID int64,
+	invitedBy string,
+) error {
+	_, err := database.conn.ExecContext(ctx,
+		`INSERT OR IGNORE INTO channel_invites
+		 (channel_id, session_id, invited_by, created_at)
+		 VALUES (?, ?, ?, ?)`,
+		channelID, sessionID, invitedBy, time.Now())
+	if err != nil {
+		return fmt.Errorf("add channel invite: %w", err)
+	}
+
+	return nil
+}
+
+// HasChannelInvite checks if a session has been invited
+// to a channel.
+func (database *Database) HasChannelInvite(
+	ctx context.Context,
+	channelID, sessionID int64,
+) (bool, error) {
+	var count int
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM channel_invites
+		 WHERE channel_id = ? AND session_id = ?`,
+		channelID, sessionID,
+	).Scan(&count)
+	if err != nil {
+		return false, fmt.Errorf(
+			"check invite: %w", err,
+		)
+	}
+
+	return count > 0, nil
+}
+
+// ClearChannelInvite removes a session's invite to a
+// channel (called after successful JOIN).
+func (database *Database) ClearChannelInvite(
+	ctx context.Context,
+	channelID, sessionID int64,
+) error {
+	_, err := database.conn.ExecContext(ctx,
+		`DELETE FROM channel_invites
+		 WHERE channel_id = ? AND session_id = ?`,
+		channelID, sessionID)
+	if err != nil {
+		return fmt.Errorf("clear invite: %w", err)
+	}
+
+	return nil
+}
+
+// --- Tier 2: Secret (+s) ---
+
+// IsChannelSecret checks if a channel has +s mode.
+func (database *Database) IsChannelSecret(
+	ctx context.Context,
+	channelID int64,
+) (bool, error) {
+	var isSecret int
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT is_secret FROM channels
+		 WHERE id = ?`,
+		channelID,
+	).Scan(&isSecret)
+	if err != nil {
+		return false, fmt.Errorf(
+			"check secret: %w", err,
+		)
+	}
+
+	return isSecret != 0, nil
+}
+
+// SetChannelSecret sets or unsets +s mode.
+func (database *Database) SetChannelSecret(
+	ctx context.Context,
+	channelID int64,
+	secret bool,
+) error {
+	val := 0
+	if secret {
+		val = 1
+	}
+
+	_, err := database.conn.ExecContext(ctx,
+		`UPDATE channels
+		 SET is_secret = ?, updated_at = ?
+		 WHERE id = ?`,
+		val, time.Now(), channelID)
+	if err != nil {
+		return fmt.Errorf("set secret: %w", err)
+	}
+
+	return nil
+}
+
+// --- No External Messages (+n) ---
+
+// IsChannelNoExternal checks if a channel has +n mode.
+func (database *Database) IsChannelNoExternal(
+	ctx context.Context,
+	channelID int64,
+) (bool, error) {
+	var isNoExternal int
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT is_no_external FROM channels
+		 WHERE id = ?`,
+		channelID,
+	).Scan(&isNoExternal)
+	if err != nil {
+		return false, fmt.Errorf(
+			"check no external: %w", err,
+		)
+	}
+
+	return isNoExternal != 0, nil
+}
+
+// SetChannelNoExternal sets or unsets +n mode.
+func (database *Database) SetChannelNoExternal(
+	ctx context.Context,
+	channelID int64,
+	noExternal bool,
+) error {
+	val := 0
+	if noExternal {
+		val = 1
+	}
+
+	_, err := database.conn.ExecContext(ctx,
+		`UPDATE channels
+		 SET is_no_external = ?, updated_at = ?
+		 WHERE id = ?`,
+		val, time.Now(), channelID)
+	if err != nil {
+		return fmt.Errorf("set no external: %w", err)
+	}
+
+	return nil
+}
+
+// ListAllChannelsWithCountsFiltered returns all channels
+// with member counts, excluding secret channels that
+// the given session is not a member of.
+//
+//nolint:dupl // different query+type vs ListChannelBans
+func (database *Database) ListAllChannelsWithCountsFiltered(
+	ctx context.Context,
+	sessionID int64,
+) ([]ChannelInfoFull, error) {
+	rows, err := database.conn.QueryContext(ctx,
+		`SELECT c.name, COUNT(cm.id) AS member_count,
+		        c.topic
+		 FROM channels c
+		 LEFT JOIN channel_members cm
+		   ON cm.channel_id = c.id
+		 WHERE c.is_secret = 0
+		    OR c.id IN (
+		       SELECT channel_id FROM channel_members
+		       WHERE session_id = ?
+		    )
+		 GROUP BY c.id
+		 ORDER BY c.name ASC`,
+		sessionID)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"list channels filtered: %w", err,
+		)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var channels []ChannelInfoFull
+
+	for rows.Next() {
+		var chanInfo ChannelInfoFull
+
+		if scanErr := rows.Scan(
+			&chanInfo.Name,
+			&chanInfo.MemberCount,
+			&chanInfo.Topic,
+		); scanErr != nil {
+			return nil, fmt.Errorf(
+				"scan channel: %w", scanErr,
+			)
+		}
+
+		channels = append(channels, chanInfo)
+	}
+
+	if rowErr := rows.Err(); rowErr != nil {
+		return nil, fmt.Errorf(
+			"iterate channels: %w", rowErr,
+		)
+	}
+
+	return channels, nil
+}
+
+// GetSessionChannelsFiltered returns channels a session
+// belongs to, optionally excluding secret channels for
+// WHOIS (when the querier is not in the same channel).
+// If querierID == targetID, returns all channels.
+func (database *Database) GetSessionChannelsFiltered(
+	ctx context.Context,
+	targetSID, querierSID int64,
+) ([]ChannelInfo, error) {
+	// If querying yourself, return all channels.
+	if targetSID == querierSID {
+		return database.GetSessionChannels(ctx, targetSID)
+	}
+
+	rows, err := database.conn.QueryContext(ctx,
+		`SELECT c.id, c.name, c.topic
+		 FROM channels c
+		 JOIN channel_members cm
+		   ON cm.channel_id = c.id
+		 WHERE cm.session_id = ?
+		   AND (c.is_secret = 0
+		        OR c.id IN (
+		           SELECT channel_id FROM channel_members
+		           WHERE session_id = ?
+		        ))
+		 ORDER BY c.name ASC`,
+		targetSID, querierSID)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"get session channels filtered: %w", err,
+		)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var channels []ChannelInfo
+
+	for rows.Next() {
+		var chanInfo ChannelInfo
+
+		if scanErr := rows.Scan(
+			&chanInfo.ID,
+			&chanInfo.Name,
+			&chanInfo.Topic,
+		); scanErr != nil {
+			return nil, fmt.Errorf(
+				"scan channel: %w", scanErr,
+			)
+		}
+
+		channels = append(channels, chanInfo)
+	}
+
+	if rowErr := rows.Err(); rowErr != nil {
+		return nil, fmt.Errorf(
+			"iterate channels: %w", rowErr,
+		)
+	}
+
+	return channels, nil
+}
+
+// --- Tier 2: Channel Key (+k) ---
+
+// GetChannelKey returns the key for a channel (empty
+// string means no key set).
+func (database *Database) GetChannelKey(
+	ctx context.Context,
+	channelID int64,
+) (string, error) {
+	var key string
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT channel_key FROM channels
+		 WHERE id = ?`,
+		channelID,
+	).Scan(&key)
+	if err != nil {
+		return "", fmt.Errorf("get channel key: %w", err)
+	}
+
+	return key, nil
+}
+
+// SetChannelKey sets or clears the key for a channel.
+func (database *Database) SetChannelKey(
+	ctx context.Context,
+	channelID int64,
+	key string,
+) error {
+	_, err := database.conn.ExecContext(ctx,
+		`UPDATE channels
+		 SET channel_key = ?, updated_at = ?
+		 WHERE id = ?`,
+		key, time.Now(), channelID)
+	if err != nil {
+		return fmt.Errorf("set channel key: %w", err)
+	}
+
+	return nil
+}
+
+// --- Tier 2: User Limit (+l) ---
+
+// GetChannelUserLimit returns the user limit for a
+// channel (0 means no limit).
+func (database *Database) GetChannelUserLimit(
+	ctx context.Context,
+	channelID int64,
+) (int, error) {
+	var limit int
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT user_limit FROM channels
+		 WHERE id = ?`,
+		channelID,
+	).Scan(&limit)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"get channel user limit: %w", err,
+		)
+	}
+
+	return limit, nil
+}
+
+// SetChannelUserLimit sets the user limit for a channel.
+func (database *Database) SetChannelUserLimit(
+	ctx context.Context,
+	channelID int64,
+	limit int,
+) error {
+	_, err := database.conn.ExecContext(ctx,
+		`UPDATE channels
+		 SET user_limit = ?, updated_at = ?
+		 WHERE id = ?`,
+		limit, time.Now(), channelID)
+	if err != nil {
+		return fmt.Errorf(
+			"set channel user limit: %w", err,
+		)
+	}
+
+	return nil
+}
+
+// SetSessionUserModes applies a set of user-mode flag
+// changes to a session inside a single transaction, so a
+// multi-mode change such as "+w-o" is all-or-nothing. A nil
+// pointer means the caller did not mention that mode and
+// the stored value must be left untouched.
+func (database *Database) SetSessionUserModes(
+	ctx context.Context,
+	sessionID int64,
+	wallops *bool,
+	oper *bool,
+) error {
+	if wallops == nil && oper == nil {
+		return nil
+	}
+
+	transaction, err := database.conn.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin tx: %w", err)
+	}
+
+	if wallops != nil {
+		if _, err := transaction.ExecContext(
+			ctx,
+			`UPDATE sessions SET is_wallops = ? WHERE id = ?`,
+			boolToInt(*wallops), sessionID,
+		); err != nil {
+			_ = transaction.Rollback()
+
+			return fmt.Errorf(
+				"set session wallops: %w", err,
+			)
+		}
+	}
+
+	if oper != nil {
+		if _, err := transaction.ExecContext(
+			ctx,
+			`UPDATE sessions SET is_oper = ? WHERE id = ?`,
+			boolToInt(*oper), sessionID,
+		); err != nil {
+			_ = transaction.Rollback()
+
+			return fmt.Errorf("set session oper: %w", err)
+		}
+	}
+
+	if err := transaction.Commit(); err != nil {
+		_ = transaction.Rollback()
+
+		return fmt.Errorf("commit user modes: %w", err)
+	}
+
+	return nil
+}
+
+// boolToInt renders a Go bool as the 0/1 integer used for
+// boolean columns in the SQLite schema.
+func boolToInt(value bool) int {
+	if value {
+		return 1
+	}
+
+	return 0
+}
+
+// SetSessionWallops sets the wallops (+w) flag on a
+// session.
+func (database *Database) SetSessionWallops(
+	ctx context.Context,
+	sessionID int64,
+	enabled bool,
+) error {
+	val := 0
+	if enabled {
+		val = 1
+	}
+
+	_, err := database.conn.ExecContext(
+		ctx,
+		`UPDATE sessions SET is_wallops = ? WHERE id = ?`,
+		val, sessionID,
+	)
+	if err != nil {
+		return fmt.Errorf("set session wallops: %w", err)
+	}
+
+	return nil
+}
+
+// IsSessionWallops returns whether the session has the
+// wallops (+w) usermode set.
+func (database *Database) IsSessionWallops(
+	ctx context.Context,
+	sessionID int64,
+) (bool, error) {
+	var isWallops int
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		`SELECT is_wallops FROM sessions WHERE id = ?`,
+		sessionID,
+	).Scan(&isWallops)
+	if err != nil {
+		return false, fmt.Errorf(
+			"check session wallops: %w", err,
+		)
+	}
+
+	return isWallops != 0, nil
+}
+
+// GetWallopsSessionIDs returns all session IDs that have
+// the wallops (+w) usermode set.
+func (database *Database) GetWallopsSessionIDs(
+	ctx context.Context,
+) ([]int64, error) {
+	rows, err := database.conn.QueryContext(
+		ctx,
+		`SELECT id FROM sessions WHERE is_wallops = 1`,
+	)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"get wallops sessions: %w", err,
+		)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var ids []int64
+
+	for rows.Next() {
+		var sessionID int64
+		if scanErr := rows.Scan(&sessionID); scanErr != nil {
+			return nil, fmt.Errorf(
+				"scan wallops session: %w", scanErr,
+			)
+		}
+
+		ids = append(ids, sessionID)
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf(
+			"iterate wallops sessions: %w", err,
+		)
+	}
+
+	return ids, nil
+}
+
+// UserhostInfo holds the data needed for RPL_USERHOST.
+type UserhostInfo struct {
+	Nick        string
+	Username    string
+	Hostname    string
+	IsOper      bool
+	AwayMessage string
+}
+
+// GetUserhostInfo returns USERHOST info for the given
+// nicks. Nicks with no session are omitted from the
+// result; any other database failure is returned, because
+// an unreadable row is not the same as an absent one.
+func (database *Database) GetUserhostInfo(
+	ctx context.Context,
+	nicks []string,
+) ([]UserhostInfo, error) {
+	if len(nicks) == 0 {
+		return nil, nil
+	}
+
+	results := make([]UserhostInfo, 0, len(nicks))
+
+	for _, nick := range nicks {
+		var info UserhostInfo
+
+		err := database.conn.QueryRowContext(
+			ctx,
+			`SELECT nick, username, hostname,
+			        is_oper, away_message
+			 FROM sessions WHERE nick = ?`,
+			nick,
+		).Scan(
+			&info.Nick, &info.Username, &info.Hostname,
+			&info.IsOper, &info.AwayMessage,
+		)
+		if err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				continue // nick not online
+			}
+
+			return nil, fmt.Errorf(
+				"userhost lookup %q: %w", nick, err,
+			)
+		}
+
+		results = append(results, info)
+	}
+
+	return results, nil
+}

internal/db/queries_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"git.eeqj.de/sneak/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/db"
 
 	_ "modernc.org/sqlite"
 )
@@ -1017,3 +1017,598 @@ func TestGetOperCount(t *testing.T) {
 		t.Fatalf("expected 1 oper, got %d", count)
 	}
 }
+
+// --- Tier 2 Tests ---
+
+func TestWildcardMatch(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		pattern string
+		input   string
+		match   bool
+	}{
+		{"*!*@*", "nick!user@host", true},
+		{"*!*@*.example.com", "nick!user@foo.example.com", true},
+		{"*!*@*.example.com", "nick!user@other.net", false},
+		{"badnick!*@*", "badnick!user@host", true},
+		{"badnick!*@*", "goodnick!user@host", false},
+		{"nick!user@host", "nick!user@host", true},
+		{"nick!user@host", "nick!user@other", false},
+		{"*", "anything", true},
+		{"?ick!*@*", "nick!user@host", true},
+		{"?ick!*@*", "nn!user@host", false},
+		// Case-insensitive.
+		{"Nick!*@*", "nick!user@host", true},
+	}
+
+	for _, tc := range tests {
+		result := db.MatchBanMask(tc.pattern, tc.input)
+		if result != tc.match {
+			t.Errorf(
+				"MatchBanMask(%q, %q) = %v, want %v",
+				tc.pattern, tc.input, result, tc.match,
+			)
+		}
+	}
+}
+
+func TestChannelBanCRUD(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	chID, err := database.GetOrCreateChannel(ctx, "#test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// No bans initially.
+	bans, err := database.ListChannelBans(ctx, chID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(bans) != 0 {
+		t.Fatalf("expected 0 bans, got %d", len(bans))
+	}
+
+	// Add a ban.
+	err = database.AddChannelBan(
+		ctx, chID, "*!*@evil.com", "op",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bans, err = database.ListChannelBans(ctx, chID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(bans) != 1 {
+		t.Fatalf("expected 1 ban, got %d", len(bans))
+	}
+
+	if bans[0].Mask != "*!*@evil.com" {
+		t.Fatalf("wrong mask: %s", bans[0].Mask)
+	}
+
+	// Duplicate add is ignored (OR IGNORE).
+	err = database.AddChannelBan(
+		ctx, chID, "*!*@evil.com", "op2",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bans, _ = database.ListChannelBans(ctx, chID)
+	if len(bans) != 1 {
+		t.Fatalf("expected 1 ban after dup, got %d", len(bans))
+	}
+
+	// Remove ban.
+	err = database.RemoveChannelBan(
+		ctx, chID, "*!*@evil.com",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bans, _ = database.ListChannelBans(ctx, chID)
+	if len(bans) != 0 {
+		t.Fatalf("expected 0 bans after remove, got %d", len(bans))
+	}
+}
+
+func TestIsSessionBanned(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sid, _, _, err := database.CreateSession(
+		ctx, "victim", "victim", "evil.com", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	chID, err := database.GetOrCreateChannel(ctx, "#bantest")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Not banned initially.
+	banned, err := database.IsSessionBanned(ctx, chID, sid)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if banned {
+		t.Fatal("should not be banned initially")
+	}
+
+	// Add ban matching the hostmask.
+	err = database.AddChannelBan(
+		ctx, chID, "*!*@evil.com", "op",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	banned, err = database.IsSessionBanned(ctx, chID, sid)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !banned {
+		t.Fatal("should be banned")
+	}
+}
+
+func TestChannelInviteOnly(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	chID, err := database.GetOrCreateChannel(ctx, "#invite")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Default: not invite-only.
+	isIO, err := database.IsChannelInviteOnly(ctx, chID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if isIO {
+		t.Fatal("should not be invite-only by default")
+	}
+
+	// Set invite-only.
+	err = database.SetChannelInviteOnly(ctx, chID, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	isIO, _ = database.IsChannelInviteOnly(ctx, chID)
+	if !isIO {
+		t.Fatal("should be invite-only")
+	}
+
+	// Unset.
+	err = database.SetChannelInviteOnly(ctx, chID, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	isIO, _ = database.IsChannelInviteOnly(ctx, chID)
+	if isIO {
+		t.Fatal("should not be invite-only")
+	}
+}
+
+func TestChannelInviteCRUD(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sid, _, _, err := database.CreateSession(
+		ctx, "invited", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	chID, err := database.GetOrCreateChannel(ctx, "#inv")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// No invite initially.
+	has, err := database.HasChannelInvite(ctx, chID, sid)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if has {
+		t.Fatal("should not have invite")
+	}
+
+	// Add invite.
+	err = database.AddChannelInvite(ctx, chID, sid, "op")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	has, _ = database.HasChannelInvite(ctx, chID, sid)
+	if !has {
+		t.Fatal("should have invite")
+	}
+
+	// Clear invite.
+	err = database.ClearChannelInvite(ctx, chID, sid)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	has, _ = database.HasChannelInvite(ctx, chID, sid)
+	if has {
+		t.Fatal("invite should be cleared")
+	}
+}
+
+func TestChannelSecret(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	chID, err := database.GetOrCreateChannel(ctx, "#secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Default: not secret.
+	isSec, err := database.IsChannelSecret(ctx, chID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if isSec {
+		t.Fatal("should not be secret by default")
+	}
+
+	err = database.SetChannelSecret(ctx, chID, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	isSec, _ = database.IsChannelSecret(ctx, chID)
+	if !isSec {
+		t.Fatal("should be secret")
+	}
+}
+
+// createTestSession is a helper to create a session and
+// return only the session ID.
+func createTestSession(
+	t *testing.T,
+	database *db.Database,
+	nick string,
+) int64 {
+	t.Helper()
+
+	sid, _, _, err := database.CreateSession(
+		t.Context(), nick, "", "", "",
+	)
+	if err != nil {
+		t.Fatalf("create session %s: %v", nick, err)
+	}
+
+	return sid
+}
+
+func TestSecretChannelFiltering(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	// Create two sessions.
+	sid1 := createTestSession(t, database, "member")
+	sid2 := createTestSession(t, database, "outsider")
+
+	// Create a secret channel.
+	chID, _ := database.GetOrCreateChannel(ctx, "#secret")
+	_ = database.SetChannelSecret(ctx, chID, true)
+	_ = database.JoinChannel(ctx, chID, sid1)
+
+	// Create a non-secret channel.
+	chID2, _ := database.GetOrCreateChannel(ctx, "#public")
+	_ = database.JoinChannel(ctx, chID2, sid1)
+
+	// Member should see both.
+	list, err := database.ListAllChannelsWithCountsFiltered(
+		ctx, sid1,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(list) != 2 {
+		t.Fatalf("member should see 2 channels, got %d", len(list))
+	}
+
+	// Outsider should only see public.
+	list, _ = database.ListAllChannelsWithCountsFiltered(
+		ctx, sid2,
+	)
+	if len(list) != 1 {
+		t.Fatalf("outsider should see 1 channel, got %d", len(list))
+	}
+
+	if list[0].Name != "#public" {
+		t.Fatalf("outsider should see #public, got %s", list[0].Name)
+	}
+}
+
+func TestWhoisChannelFiltering(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sid1 := createTestSession(t, database, "target")
+	sid2 := createTestSession(t, database, "querier")
+
+	// Create secret channel, target joins it.
+	chID, _ := database.GetOrCreateChannel(ctx, "#hidden")
+	_ = database.SetChannelSecret(ctx, chID, true)
+	_ = database.JoinChannel(ctx, chID, sid1)
+
+	// Querier (non-member) should not see the channel.
+	channels, err := database.GetSessionChannelsFiltered(
+		ctx, sid1, sid2,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(channels) != 0 {
+		t.Fatalf(
+			"querier should see 0 channels, got %d",
+			len(channels),
+		)
+	}
+
+	// Target querying self should see it.
+	channels, _ = database.GetSessionChannelsFiltered(
+		ctx, sid1, sid1,
+	)
+	if len(channels) != 1 {
+		t.Fatalf(
+			"self-query should see 1 channel, got %d",
+			len(channels),
+		)
+	}
+}
+
+//nolint:dupl // structurally similar to TestChannelUserLimit
+func TestChannelKey(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	chID, err := database.GetOrCreateChannel(ctx, "#keyed")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Default: no key.
+	key, err := database.GetChannelKey(ctx, chID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if key != "" {
+		t.Fatalf("expected empty key, got %q", key)
+	}
+
+	// Set key.
+	err = database.SetChannelKey(ctx, chID, "secret123")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	key, _ = database.GetChannelKey(ctx, chID)
+	if key != "secret123" {
+		t.Fatalf("expected secret123, got %q", key)
+	}
+
+	// Clear key.
+	err = database.SetChannelKey(ctx, chID, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	key, _ = database.GetChannelKey(ctx, chID)
+	if key != "" {
+		t.Fatalf("expected empty key, got %q", key)
+	}
+}
+
+//nolint:dupl // structurally similar to TestChannelKey
+func TestChannelUserLimit(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	chID, err := database.GetOrCreateChannel(ctx, "#limited")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Default: no limit.
+	limit, err := database.GetChannelUserLimit(ctx, chID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if limit != 0 {
+		t.Fatalf("expected 0 limit, got %d", limit)
+	}
+
+	// Set limit.
+	err = database.SetChannelUserLimit(ctx, chID, 50)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	limit, _ = database.GetChannelUserLimit(ctx, chID)
+	if limit != 50 {
+		t.Fatalf("expected 50, got %d", limit)
+	}
+
+	// Clear limit.
+	err = database.SetChannelUserLimit(ctx, chID, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	limit, _ = database.GetChannelUserLimit(ctx, chID)
+	if limit != 0 {
+		t.Fatalf("expected 0, got %d", limit)
+	}
+}
+
+// TestSetSessionUserModesIsAtomic proves that a multi-mode
+// change is all-or-nothing.  A trigger makes the is_oper
+// UPDATE fail after the is_wallops UPDATE has already run,
+// which is exactly the "+w-o" partial-failure the previous
+// implementation exhibited: it issued the two UPDATEs
+// independently, so +w persisted while the caller reported
+// total failure.
+func TestSetSessionUserModesIsAtomic(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sessionID, _, _, err := database.CreateSession(
+		ctx, "alice", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = database.ExecForTest(ctx,
+		`CREATE TRIGGER reject_oper
+		 BEFORE UPDATE OF is_oper ON sessions
+		 BEGIN SELECT RAISE(ABORT, 'oper write rejected');
+		 END`,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	wallops := true
+	oper := false
+
+	err = database.SetSessionUserModes(
+		ctx, sessionID, &wallops, &oper,
+	)
+	if err == nil {
+		t.Fatal("expected the rejected oper write to fail")
+	}
+
+	gotWallops, err := database.IsSessionWallops(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if gotWallops {
+		t.Error(
+			"wallops persisted despite the transaction " +
+				"failing; the apply stage is not atomic",
+		)
+	}
+}
+
+// TestSetSessionUserModesAppliesBoth is the success-path
+// counterpart: when nothing fails, both flags are written,
+// and a nil pointer leaves that flag untouched.
+func TestSetSessionUserModesAppliesBoth(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sessionID, _, _, err := database.CreateSession(
+		ctx, "alice", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := database.SetSessionOper(
+		ctx, sessionID, true,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	wallops := true
+	oper := false
+
+	if err := database.SetSessionUserModes(
+		ctx, sessionID, &wallops, &oper,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	gotWallops, err := database.IsSessionWallops(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	gotOper, err := database.IsSessionOper(ctx, sessionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !gotWallops || gotOper {
+		t.Errorf(
+			"want wallops=true oper=false, got %v/%v",
+			gotWallops, gotOper,
+		)
+	}
+
+	// A nil pointer must leave the stored value alone.
+	if err := database.SetSessionUserModes(
+		ctx, sessionID, nil, nil,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	gotWallops, err = database.IsSessionWallops(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !gotWallops {
+		t.Error("nil pointers must not clear wallops")
+	}
+}

internal/db/schema/000.sql

@@ -0,0 +1,6 @@
+-- Bootstrap: create the schema_migrations table itself.
+CREATE TABLE IF NOT EXISTS schema_migrations (
+    version INTEGER PRIMARY KEY,
+    applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+INSERT OR IGNORE INTO schema_migrations (version) VALUES (0);

internal/db/schema/001_initial.sql

@@ -10,6 +10,7 @@ CREATE TABLE IF NOT EXISTS sessions (
     hostname TEXT NOT NULL DEFAULT '',
     ip TEXT NOT NULL DEFAULT '',
     is_oper INTEGER NOT NULL DEFAULT 0,
+    is_wallops INTEGER NOT NULL DEFAULT 0,
     password_hash TEXT NOT NULL DEFAULT '',
     signing_key TEXT NOT NULL DEFAULT '',
     away_message TEXT NOT NULL DEFAULT '',
@@ -42,10 +43,37 @@ CREATE TABLE IF NOT EXISTS channels (
     hashcash_bits INTEGER NOT NULL DEFAULT 0,
     is_moderated INTEGER NOT NULL DEFAULT 0,
     is_topic_locked INTEGER NOT NULL DEFAULT 1,
+    is_invite_only INTEGER NOT NULL DEFAULT 0,
+    is_secret INTEGER NOT NULL DEFAULT 0,
+    is_no_external INTEGER NOT NULL DEFAULT 1,
+    channel_key TEXT NOT NULL DEFAULT '',
+    user_limit INTEGER NOT NULL DEFAULT 0,
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
 
+-- Channel bans
+CREATE TABLE IF NOT EXISTS channel_bans (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    mask TEXT NOT NULL,
+    set_by TEXT NOT NULL,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(channel_id, mask)
+);
+CREATE INDEX IF NOT EXISTS idx_channel_bans_channel ON channel_bans(channel_id);
+
+-- Channel invites (in-memory would be simpler but DB survives restarts)
+CREATE TABLE IF NOT EXISTS channel_invites (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    session_id INTEGER NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+    invited_by TEXT NOT NULL DEFAULT '',
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(channel_id, session_id)
+);
+CREATE INDEX IF NOT EXISTS idx_channel_invites_channel ON channel_invites(channel_id);
+
 -- Channel members
 CREATE TABLE IF NOT EXISTS channel_members (
     id INTEGER PRIMARY KEY AUTOINCREMENT,

internal/handlers/api_test.go

@@ -18,20 +18,21 @@ import (
 	"testing"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/broker"
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/handlers"
-	"git.eeqj.de/sneak/neoirc/internal/hashcash"
-	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
-	"git.eeqj.de/sneak/neoirc/internal/middleware"
-	"git.eeqj.de/sneak/neoirc/internal/server"
-	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
 	"golang.org/x/crypto/bcrypt"
+	"sneak.berlin/go/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/handlers"
+	"sneak.berlin/go/neoirc/internal/hashcash"
+	"sneak.berlin/go/neoirc/internal/healthcheck"
+	"sneak.berlin/go/neoirc/internal/logger"
+	"sneak.berlin/go/neoirc/internal/middleware"
+	"sneak.berlin/go/neoirc/internal/server"
+	"sneak.berlin/go/neoirc/internal/service"
+	"sneak.berlin/go/neoirc/internal/stats"
 )
 
 func TestMain(m *testing.M) {
@@ -207,6 +208,15 @@ func newTestHandlers(
 	hcheck *healthcheck.Healthcheck,
 	tracker *stats.Tracker,
 ) (*handlers.Handlers, error) {
+	brk := broker.New()
+	svc := service.New(service.Params{ //nolint:exhaustruct
+		Logger:   log,
+		Config:   cfg,
+		Database: database,
+		Broker:   brk,
+		Globals:  globs,
+	})
+
 	hdlr, err := handlers.New(lifecycle, handlers.Params{ //nolint:exhaustruct
 		Logger:      log,
 		Globals:     globs,
@@ -214,7 +224,8 @@ func newTestHandlers(
 		Database:    database,
 		Healthcheck: hcheck,
 		Stats:       tracker,
-		Broker:      broker.New(),
+		Broker:      brk,
+		Service:     svc,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("test handlers: %w", err)
@@ -4380,3 +4391,486 @@ func TestKickDefaultReason(t *testing.T) {
 		)
 	}
 }
+
+// --- Tier 2 Handler Tests ---
+
+const (
+	inviteCmd    = "INVITE"
+	joinedStatus = "joined"
+)
+
+// TestBanAddRemoveList verifies +b add, list, and -b
+// remove via MODE commands.
+func TestBanAddRemoveList(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("banop")
+
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#bans",
+	})
+
+	// Add a ban.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#bans",
+		bodyKey:    []string{"+b", "*!*@evil.com"},
+	})
+
+	_, lastID := tserver.pollMessages(opToken, 0)
+
+	// List bans (+b with no argument).
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#bans",
+		bodyKey:    []string{"+b"},
+	})
+
+	msgs, _ := tserver.pollMessages(opToken, lastID)
+
+	// Should have RPL_BANLIST (367).
+	banMsg := findNumericWithParams(msgs, "367")
+	if banMsg == nil {
+		t.Fatalf("expected 367 RPL_BANLIST, got %v", msgs)
+	}
+
+	// Should have RPL_ENDOFBANLIST (368).
+	if !findNumeric(msgs, "368") {
+		t.Fatal("expected 368 RPL_ENDOFBANLIST")
+	}
+
+	// Remove the ban.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#bans",
+		bodyKey:    []string{"-b", "*!*@evil.com"},
+	})
+
+	_, lastID = tserver.pollMessages(opToken, lastID)
+
+	// List again — should be empty (just end-of-list).
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#bans",
+		bodyKey:    []string{"+b"},
+	})
+
+	msgs, _ = tserver.pollMessages(opToken, lastID)
+	banMsg = findNumericWithParams(msgs, "367")
+	if banMsg != nil {
+		t.Fatal("expected no 367 after ban removal")
+	}
+
+	if !findNumeric(msgs, "368") {
+		t.Fatal("expected 368 RPL_ENDOFBANLIST")
+	}
+}
+
+// TestBanBlocksJoin verifies that a banned user cannot
+// join a channel.
+func TestBanBlocksJoin(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("banop2")
+	userToken := tserver.createSession("banned2")
+
+	// Op creates channel and sets a ban.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#banjoin",
+	})
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#banjoin",
+		bodyKey:    []string{"+b", "banned2!*@*"},
+	})
+
+	// Banned user tries to join.
+	_, lastID := tserver.pollMessages(userToken, 0)
+	tserver.sendCommand(userToken, map[string]any{
+		commandKey: joinCmd, toKey: "#banjoin",
+	})
+
+	msgs, _ := tserver.pollMessages(userToken, lastID)
+
+	// Should get ERR_BANNEDFROMCHAN (474).
+	if !findNumeric(msgs, "474") {
+		t.Fatalf("expected 474 ERR_BANNEDFROMCHAN, got %v", msgs)
+	}
+}
+
+// TestBanBlocksPrivmsg verifies that a banned user who
+// is already in a channel cannot send messages.
+func TestBanBlocksPrivmsg(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("banmsgop")
+	userToken := tserver.createSession("banmsgusr")
+
+	// Both join.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#banmsg",
+	})
+	tserver.sendCommand(userToken, map[string]any{
+		commandKey: joinCmd, toKey: "#banmsg",
+	})
+
+	// Op bans the user.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#banmsg",
+		bodyKey:    []string{"+b", "banmsgusr!*@*"},
+	})
+
+	// User tries to send a message.
+	_, lastID := tserver.pollMessages(userToken, 0)
+	tserver.sendCommand(userToken, map[string]any{
+		commandKey: privmsgCmd,
+		toKey:      "#banmsg",
+		bodyKey:    []string{"hello"},
+	})
+
+	msgs, _ := tserver.pollMessages(userToken, lastID)
+
+	// Should get ERR_CANNOTSENDTOCHAN (404).
+	if !findNumeric(msgs, "404") {
+		t.Fatalf("expected 404 ERR_CANNOTSENDTOCHAN, got %v", msgs)
+	}
+}
+
+// TestInviteOnlyJoin verifies +i behavior: join rejected
+// without invite, accepted with invite.
+func TestInviteOnlyJoin(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("invop")
+	userToken := tserver.createSession("invusr")
+
+	// Op creates channel and sets +i.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#invonly",
+	})
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#invonly",
+		bodyKey:    []string{"+i"},
+	})
+
+	// User tries to join without invite.
+	_, lastID := tserver.pollMessages(userToken, 0)
+	tserver.sendCommand(userToken, map[string]any{
+		commandKey: joinCmd, toKey: "#invonly",
+	})
+
+	msgs, _ := tserver.pollMessages(userToken, lastID)
+
+	if !findNumeric(msgs, "473") {
+		t.Fatalf(
+			"expected 473 ERR_INVITEONLYCHAN, got %v",
+			msgs,
+		)
+	}
+
+	// Op invites user.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: inviteCmd,
+		bodyKey:    []string{"invusr", "#invonly"},
+	})
+
+	// User tries again — should succeed with invite.
+	_, result := tserver.sendCommand(userToken, map[string]any{
+		commandKey: joinCmd, toKey: "#invonly",
+	})
+
+	if result[statusKey] != joinedStatus {
+		t.Fatalf(
+			"expected join to succeed with invite, got %v",
+			result,
+		)
+	}
+}
+
+// TestSecretChannelHiddenFromList verifies +s hides a
+// channel from LIST for non-members.
+func TestSecretChannelHiddenFromList(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("secop")
+	outsiderToken := tserver.createSession("secout")
+
+	// Op creates secret channel.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#secret",
+	})
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#secret",
+		bodyKey:    []string{"+s"},
+	})
+
+	// Outsider does LIST.
+	_, lastID := tserver.pollMessages(outsiderToken, 0)
+	tserver.sendCommand(outsiderToken, map[string]any{
+		commandKey: "LIST",
+	})
+
+	msgs, _ := tserver.pollMessages(outsiderToken, lastID)
+
+	// Should NOT see #secret in any 322 (RPL_LIST).
+	for _, msg := range msgs {
+		code, ok := msg["code"].(float64)
+		if !ok || int(code) != 322 {
+			continue
+		}
+
+		params := getNumericParams(msg)
+		for _, p := range params {
+			if p == "#secret" {
+				t.Fatal("outsider should not see #secret in LIST")
+			}
+		}
+	}
+
+	// Member does LIST — should see it.
+	_, lastID = tserver.pollMessages(opToken, 0)
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: "LIST",
+	})
+
+	msgs, _ = tserver.pollMessages(opToken, lastID)
+
+	found := false
+
+	for _, msg := range msgs {
+		code, ok := msg["code"].(float64)
+		if !ok || int(code) != 322 {
+			continue
+		}
+
+		params := getNumericParams(msg)
+		for _, p := range params {
+			if p == "#secret" {
+				found = true
+			}
+		}
+	}
+
+	if !found {
+		t.Fatal("member should see #secret in LIST")
+	}
+}
+
+// TestChannelKeyJoin verifies +k behavior: wrong/missing
+// key is rejected, correct key allows join.
+func TestChannelKeyJoin(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("keyop")
+	userToken := tserver.createSession("keyusr")
+
+	// Op creates keyed channel.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#keyed",
+	})
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#keyed",
+		bodyKey:    []string{"+k", "mykey"},
+	})
+
+	// User tries without key.
+	_, lastID := tserver.pollMessages(userToken, 0)
+	tserver.sendCommand(userToken, map[string]any{
+		commandKey: joinCmd, toKey: "#keyed",
+	})
+
+	msgs, _ := tserver.pollMessages(userToken, lastID)
+
+	if !findNumeric(msgs, "475") {
+		t.Fatalf(
+			"expected 475 ERR_BADCHANNELKEY, got %v",
+			msgs,
+		)
+	}
+
+	// User tries with wrong key.
+	tserver.sendCommand(userToken, map[string]any{
+		commandKey: joinCmd,
+		toKey:      "#keyed",
+		bodyKey:    []string{"wrongkey"},
+	})
+
+	msgs, _ = tserver.pollMessages(userToken, lastID)
+	if !findNumeric(msgs, "475") {
+		t.Fatalf(
+			"expected 475 ERR_BADCHANNELKEY for wrong key, got %v",
+			msgs,
+		)
+	}
+
+	// User tries with correct key.
+	_, result := tserver.sendCommand(userToken, map[string]any{
+		commandKey: joinCmd,
+		toKey:      "#keyed",
+		bodyKey:    []string{"mykey"},
+	})
+
+	if result[statusKey] != joinedStatus {
+		t.Fatalf(
+			"expected join to succeed with correct key, got %v",
+			result,
+		)
+	}
+}
+
+// TestUserLimitEnforcement verifies +l behavior: blocks
+// join when at capacity.
+func TestUserLimitEnforcement(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("limop")
+	user1Token := tserver.createSession("limusr1")
+	user2Token := tserver.createSession("limusr2")
+
+	// Op creates channel with limit 2.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#limited",
+	})
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd,
+		toKey:      "#limited",
+		bodyKey:    []string{"+l", "2"},
+	})
+
+	// User1 joins — should succeed (2 members now: op + user1).
+	_, result := tserver.sendCommand(user1Token, map[string]any{
+		commandKey: joinCmd, toKey: "#limited",
+	})
+	if result[statusKey] != joinedStatus {
+		t.Fatalf("user1 should join, got %v", result)
+	}
+
+	// User2 tries to join — should fail (at limit: 2/2).
+	_, lastID := tserver.pollMessages(user2Token, 0)
+	tserver.sendCommand(user2Token, map[string]any{
+		commandKey: joinCmd, toKey: "#limited",
+	})
+
+	msgs, _ := tserver.pollMessages(user2Token, lastID)
+
+	if !findNumeric(msgs, "471") {
+		t.Fatalf(
+			"expected 471 ERR_CHANNELISFULL, got %v",
+			msgs,
+		)
+	}
+}
+
+// TestModeStringIncludesNewModes verifies that querying
+// channel mode returns the new modes (+i, +s, +k, +l).
+func TestModeStringIncludesNewModes(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("modestrop")
+
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#modestr",
+	})
+
+	// Set all tier 2 modes.
+	for _, modeChange := range [][]string{
+		{"+i"}, {"+s"}, {"+k", "pw"}, {"+l", "50"},
+	} {
+		tserver.sendCommand(opToken, map[string]any{
+			commandKey: modeCmd,
+			toKey:      "#modestr",
+			bodyKey:    modeChange,
+		})
+	}
+
+	_, lastID := tserver.pollMessages(opToken, 0)
+
+	// Query mode.
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: modeCmd, toKey: "#modestr",
+	})
+
+	msgs, _ := tserver.pollMessages(opToken, lastID)
+	modeMsg := findNumericWithParams(msgs, "324")
+
+	if modeMsg == nil {
+		t.Fatal("expected 324 RPL_CHANNELMODEIS")
+	}
+
+	params := getNumericParams(modeMsg)
+	if len(params) < 2 {
+		t.Fatalf("too few params in 324: %v", params)
+	}
+
+	modeString := params[1]
+
+	for _, c := range []string{"i", "s", "k", "l"} {
+		if !strings.Contains(modeString, c) {
+			t.Fatalf(
+				"mode string %q missing %q",
+				modeString, c,
+			)
+		}
+	}
+}
+
+// TestISUPPORT verifies the 005 numeric includes the
+// updated CHANMODES string.
+func TestISUPPORT(t *testing.T) {
+	tserver := newTestServer(t)
+	token := tserver.createSession("isupport")
+
+	msgs, _ := tserver.pollMessages(token, 0)
+
+	isupp := findNumericWithParams(msgs, "005")
+	if isupp == nil {
+		t.Fatal("expected 005 RPL_ISUPPORT")
+	}
+
+	body, _ := isupp["body"].(string)
+	params := getNumericParams(isupp)
+
+	combined := body + " " + strings.Join(params, " ")
+
+	if !strings.Contains(combined, "CHANMODES=b,k,Hl,imnst") {
+		t.Fatalf(
+			"ISUPPORT missing updated CHANMODES, got body=%q params=%v",
+			body, params,
+		)
+	}
+}
+
+// TestNonOpCannotSetModes verifies non-operators
+// cannot set +i, +s, +k, +l, +b.
+func TestNonOpCannotSetModes(t *testing.T) {
+	tserver := newTestServer(t)
+	opToken := tserver.createSession("modeopx")
+	userToken := tserver.createSession("modeusrx")
+
+	tserver.sendCommand(opToken, map[string]any{
+		commandKey: joinCmd, toKey: "#noperm",
+	})
+	tserver.sendCommand(userToken, map[string]any{
+		commandKey: joinCmd, toKey: "#noperm",
+	})
+
+	modes := [][]string{
+		{"+i"}, {"+s"}, {"+k", "key"}, {"+l", "10"},
+		{"+b", "bad!*@*"},
+	}
+
+	for _, modeChange := range modes {
+		_, lastID := tserver.pollMessages(userToken, 0)
+		tserver.sendCommand(userToken, map[string]any{
+			commandKey: modeCmd,
+			toKey:      "#noperm",
+			bodyKey:    modeChange,
+		})
+
+		msgs, _ := tserver.pollMessages(userToken, lastID)
+
+		// Should get 482 ERR_CHANOPRIVSNEEDED.
+		if !findNumeric(msgs, "482") {
+			t.Fatalf(
+				"expected 482 for %v, got %v",
+				modeChange, msgs,
+			)
+		}
+	}
+}

internal/handlers/auth.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"strings"
 
-	"git.eeqj.de/sneak/neoirc/pkg/irc"
+	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 const minPasswordLength = 8

internal/handlers/handlers.go

@@ -9,16 +9,17 @@ import (
 	"net/http"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/broker"
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/hashcash"
-	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
-	"git.eeqj.de/sneak/neoirc/internal/ratelimit"
-	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/hashcash"
+	"sneak.berlin/go/neoirc/internal/healthcheck"
+	"sneak.berlin/go/neoirc/internal/logger"
+	"sneak.berlin/go/neoirc/internal/ratelimit"
+	"sneak.berlin/go/neoirc/internal/service"
+	"sneak.berlin/go/neoirc/internal/stats"
 )
 
 var errUnauthorized = errors.New("unauthorized")
@@ -34,6 +35,7 @@ type Params struct {
 	Healthcheck *healthcheck.Healthcheck
 	Stats       *stats.Tracker
 	Broker      *broker.Broker
+	Service     *service.Service
 }
 
 const defaultIdleTimeout = 30 * 24 * time.Hour
@@ -49,6 +51,7 @@ type Handlers struct {
 	log             *slog.Logger
 	hc              *healthcheck.Healthcheck
 	broker          *broker.Broker
+	svc             *service.Service
 	hashcashVal     *hashcash.Validator
 	channelHashcash *hashcash.ChannelValidator
 	loginLimiter    *ratelimit.Limiter
@@ -81,6 +84,7 @@ func New(
 		log:             params.Logger.Get(),
 		hc:              params.Healthcheck,
 		broker:          params.Broker,
+		svc:             params.Service,
 		hashcashVal:     hashcash.NewValidator(resource),
 		channelHashcash: hashcash.NewChannelValidator(),
 		loginLimiter:    ratelimit.New(loginRate, loginBurst),

internal/handlers/utility.go

@@ -0,0 +1,576 @@
+package handlers
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/service"
+	"sneak.berlin/go/neoirc/pkg/irc"
+)
+
+// maxUserhostNicks is the maximum number of nicks allowed
+// in a single USERHOST query (RFC 2812).
+const maxUserhostNicks = 5
+
+// dispatchBodyOnlyCommand routes commands that take
+// (writer, request, sessionID, clientID, nick, bodyLines).
+func (hdlr *Handlers) dispatchBodyOnlyCommand(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, command string,
+	bodyLines func() []string,
+) {
+	switch command {
+	case irc.CmdAway:
+		hdlr.handleAway(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdNick:
+		hdlr.handleNick(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdPass:
+		hdlr.handlePass(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdInvite:
+		hdlr.handleInvite(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	}
+}
+
+// dispatchOperCommand routes oper-related commands (OPER,
+// KILL, WALLOPS) to their handlers.
+func (hdlr *Handlers) dispatchOperCommand(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, command string,
+	bodyLines func() []string,
+) {
+	switch command {
+	case irc.CmdOper:
+		hdlr.handleOper(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdKill:
+		hdlr.handleKill(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdWallops:
+		hdlr.handleWallops(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	}
+}
+
+// handleUserhost handles the USERHOST command.
+// Returns user@host info for up to 5 nicks.
+func (hdlr *Handlers) handleUserhost(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	lines := bodyLines()
+	if len(lines) == 0 {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNeedMoreParams, nick,
+			[]string{irc.CmdUserhost},
+			"Not enough parameters",
+		)
+
+		return
+	}
+
+	// Limit to 5 nicks per RFC 2812.
+	nicks := lines
+	if len(nicks) > maxUserhostNicks {
+		nicks = nicks[:maxUserhostNicks]
+	}
+
+	infos, err := hdlr.params.Database.GetUserhostInfo(
+		ctx, nicks,
+	)
+	if err != nil {
+		hdlr.log.Error(
+			"userhost query failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	replyStr := hdlr.buildUserhostReply(infos)
+
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplUserHost, nick, nil,
+		replyStr,
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// buildUserhostReply builds the RPL_USERHOST reply
+// string per RFC 2812.
+func (hdlr *Handlers) buildUserhostReply(
+	infos []db.UserhostInfo,
+) string {
+	replies := make([]string, 0, len(infos))
+
+	for idx := range infos {
+		info := &infos[idx]
+
+		username := info.Username
+		if username == "" {
+			username = info.Nick
+		}
+
+		hostname := info.Hostname
+		if hostname == "" {
+			hostname = hdlr.serverName()
+		}
+
+		operStar := ""
+		if info.IsOper {
+			operStar = "*"
+		}
+
+		awayPrefix := "+"
+		if info.AwayMessage != "" {
+			awayPrefix = "-"
+		}
+
+		replies = append(replies,
+			info.Nick+operStar+"="+
+				awayPrefix+username+"@"+hostname,
+		)
+	}
+
+	return strings.Join(replies, " ")
+}
+
+// handleVersion handles the VERSION command.
+// Returns the server version string.
+func (hdlr *Handlers) handleVersion(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+) {
+	ctx := request.Context()
+	srvName := hdlr.serverName()
+	version := hdlr.svc.ServerVersion()
+
+	// 351 RPL_VERSION
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplVersion, nick,
+		[]string{version + ".", srvName},
+		"",
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleAdmin handles the ADMIN command.
+// Returns server admin contact info.
+func (hdlr *Handlers) handleAdmin(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+) {
+	ctx := request.Context()
+	srvName := hdlr.serverName()
+
+	// 256 RPL_ADMINME
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplAdminMe, nick,
+		[]string{srvName},
+		"Administrative info",
+	)
+
+	// 257 RPL_ADMINLOC1
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplAdminLoc1, nick, nil,
+		"neoirc server",
+	)
+
+	// 258 RPL_ADMINLOC2
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplAdminLoc2, nick, nil,
+		"IRC over HTTP",
+	)
+
+	// 259 RPL_ADMINEMAIL
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplAdminEmail, nick, nil,
+		"admin@"+srvName,
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleInfo handles the INFO command.
+// Returns server software information.
+func (hdlr *Handlers) handleInfo(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+) {
+	ctx := request.Context()
+
+	for _, line := range hdlr.svc.InfoLines() {
+		// 371 RPL_INFO
+		hdlr.enqueueNumeric(
+			ctx, clientID, irc.RplInfo, nick, nil,
+			line,
+		)
+	}
+
+	// 374 RPL_ENDOFINFO
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplEndOfInfo, nick, nil,
+		"End of /INFO list",
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleTime handles the TIME command.
+// Returns the server's local time in RFC format.
+func (hdlr *Handlers) handleTime(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+) {
+	ctx := request.Context()
+	srvName := hdlr.serverName()
+
+	// 391 RPL_TIME
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplTime, nick,
+		[]string{srvName},
+		time.Now().Format(time.RFC1123),
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleKill handles the KILL command.
+// Forcibly disconnects a user (oper only).
+func (hdlr *Handlers) handleKill(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	// Check oper status.
+	isOper, err := hdlr.params.Database.IsSessionOper(
+		ctx, sessionID,
+	)
+	if err != nil || !isOper {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoPrivileges, nick, nil,
+			"Permission Denied- You're not an IRC operator",
+		)
+
+		return
+	}
+
+	lines := bodyLines()
+
+	var targetNick string
+	if len(lines) > 0 {
+		targetNick = strings.TrimSpace(lines[0])
+	}
+
+	if targetNick == "" {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNeedMoreParams, nick,
+			[]string{irc.CmdKill},
+			"Not enough parameters",
+		)
+
+		return
+	}
+
+	reason := "KILLed"
+	if len(lines) > 1 {
+		reason = lines[1]
+	}
+
+	targetSID, lookupErr := hdlr.params.Database.
+		GetSessionByNick(ctx, targetNick)
+	if lookupErr != nil {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoSuchNick, nick,
+			[]string{targetNick},
+			"No such nick/channel",
+		)
+
+		return
+	}
+
+	// Do not allow killing yourself.
+	if targetSID == sessionID {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrCantKillServer, nick, nil,
+			"You cannot KILL yourself",
+		)
+
+		return
+	}
+
+	quitReason := "Killed (" + nick + " (" + reason + "))"
+
+	// KillSession broadcasts the QUIT, deletes the session
+	// and disconnects the victim's wire connection if it
+	// holds one.
+	hdlr.svc.KillSession(
+		ctx, targetSID, targetNick, quitReason,
+	)
+
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleWallops handles the WALLOPS command.
+// Broadcasts a message to all users with +w usermode
+// (oper only).
+func (hdlr *Handlers) handleWallops(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	// Check oper status.
+	isOper, err := hdlr.params.Database.IsSessionOper(
+		ctx, sessionID,
+	)
+	if err != nil || !isOper {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoPrivileges, nick, nil,
+			"Permission Denied- You're not an IRC operator",
+		)
+
+		return
+	}
+
+	lines := bodyLines()
+	if len(lines) == 0 {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNeedMoreParams, nick,
+			[]string{irc.CmdWallops},
+			"Not enough parameters",
+		)
+
+		return
+	}
+
+	message := strings.Join(lines, " ")
+
+	wallopsSIDs, err := hdlr.params.Database.
+		GetWallopsSessionIDs(ctx)
+	if err != nil {
+		hdlr.log.Error(
+			"get wallops sessions failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	if len(wallopsSIDs) > 0 {
+		body, mErr := json.Marshal([]string{message})
+		if mErr != nil {
+			hdlr.log.Error(
+				"marshal wallops body", "error", mErr,
+			)
+			hdlr.respondError(
+				writer, request,
+				"internal error",
+				http.StatusInternalServerError,
+			)
+
+			return
+		}
+
+		_ = hdlr.fanOutSilent(
+			request, irc.CmdWallops, nick, "*",
+			json.RawMessage(body), wallopsSIDs,
+		)
+	}
+
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// handleUserMode handles user mode queries and changes
+// (e.g., MODE nick, MODE nick +w). Delegates to the
+// shared service.ApplyUserMode / service.QueryUserMode so
+// that mode string processing is identical for both the
+// HTTP API and IRC wire protocol.
+func (hdlr *Handlers) handleUserMode(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, target string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	// Users can only query or change their own modes. The
+	// check is above the query/change split so that both
+	// forms are rejected, and uses EqualFold because IRC
+	// nicks are case-insensitive — matching the wire path
+	// in ircserver.handleUserMode.
+	if target != "" && !strings.EqualFold(target, nick) {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrUsersDoNotMatch, nick, nil,
+			"Can't change mode for other users",
+		)
+
+		return
+	}
+
+	lines := bodyLines()
+
+	// Mode change requested.
+	if len(lines) > 0 {
+		hdlr.changeUserMode(
+			writer, request,
+			sessionID, clientID, nick, lines[0],
+		)
+
+		return
+	}
+
+	// Mode query — delegate to shared service.
+	modeStr, err := hdlr.svc.QueryUserMode(ctx, sessionID)
+	if err != nil {
+		hdlr.log.Error(
+			"query user mode failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplUmodeIs, nick, nil,
+		modeStr,
+	)
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// changeUserMode applies a mode string to the caller's own
+// session. The caller has already verified that the target
+// nick is the caller's own.
+func (hdlr *Handlers) changeUserMode(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, modeStr string,
+) {
+	ctx := request.Context()
+
+	newModes, err := hdlr.svc.ApplyUserMode(
+		ctx, sessionID, modeStr,
+	)
+	if err != nil {
+		var ircErr *service.IRCError
+		if errors.As(err, &ircErr) {
+			hdlr.respondIRCError(
+				writer, request,
+				clientID, sessionID,
+				ircErr.Code, nick, ircErr.Params,
+				ircErr.Message,
+			)
+
+			return
+		}
+
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplUmodeIs, nick, nil,
+		newModes,
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}

internal/hashcash/channel_test.go

@@ -5,7 +5,7 @@ import (
 	"encoding/hex"
 	"testing"
 
-	"git.eeqj.de/sneak/neoirc/internal/hashcash"
+	"sneak.berlin/go/neoirc/internal/hashcash"
 )
 
 const (

internal/hashcash/hashcash_test.go

@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/hashcash"
+	"sneak.berlin/go/neoirc/internal/hashcash"
 )
 
 const testBits = 2

internal/healthcheck/healthcheck.go

@@ -6,12 +6,12 @@ import (
 	"log/slog"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
-	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/logger"
+	"sneak.berlin/go/neoirc/internal/stats"
 )
 
 // Params defines the dependencies for creating a Healthcheck.

internal/ircserver/conn.go

@@ -3,7 +3,6 @@ package ircserver
 import (
 	"bufio"
 	"context"
-	"encoding/json"
 	"fmt"
 	"log/slog"
 	"net"
@@ -12,24 +11,31 @@ import (
 	"sync"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/broker"
-	"git.eeqj.de/sneak/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/pkg/irc"
+	"sneak.berlin/go/neoirc/internal/service"
+	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 const (
 	maxLineLen      = 512
 	readTimeout     = 5 * time.Minute
 	writeTimeout    = 30 * time.Second
+	killWriteWindow = 2 * time.Second
 	dnsTimeout      = 3 * time.Second
 	pollInterval    = 100 * time.Millisecond
 	pingInterval    = 90 * time.Second
 	pongDeadline    = 30 * time.Second
 	maxNickLen      = 32
 	minPasswordLen  = 8
+	maxHashcashBits = 40
 )
 
+// cmdHandler is the signature for registered IRC command
+// handlers.
+type cmdHandler func(ctx context.Context, msg *Message)
+
 // Conn represents a single IRC client TCP connection.
 type Conn struct {
 	conn      net.Conn
@@ -37,7 +43,15 @@ type Conn struct {
 	database  *db.Database
 	brk       *broker.Broker
 	cfg       *config.Config
+	svc       *service.Service
 	serverSfx string
+	commands  map[string]cmdHandler
+
+	// writeMu serializes writes to conn.  A connection is
+	// written to by its own read loop, by its relay
+	// goroutine, and — when an operator KILLs it — by
+	// another client's goroutine.
+	writeMu sync.Mutex
 
 	mu        sync.Mutex
 	nick      string
@@ -55,6 +69,7 @@ type Conn struct {
 
 	lastQueueID int64
 	closed      bool
+	killed      bool
 	cancel      context.CancelFunc
 }
 
@@ -65,6 +80,7 @@ func newConn(
 	database *db.Database,
 	brk *broker.Broker,
 	cfg *config.Config,
+	svc *service.Service,
 ) *Conn {
 	host, _, _ := net.SplitHostPort(tcpConn.RemoteAddr().String())
 
@@ -73,16 +89,133 @@ func newConn(
 		srvName = "neoirc"
 	}
 
-	return &Conn{ //nolint:exhaustruct // zero-value defaults
+	conn := &Conn{ //nolint:exhaustruct // zero-value defaults
 		conn:      tcpConn,
 		log:       log,
 		database:  database,
 		brk:       brk,
 		cfg:       cfg,
+		svc:       svc,
 		serverSfx: srvName,
 		remoteIP:  host,
 		hostname:  resolveHost(ctx, host),
 	}
+
+	conn.commands = conn.buildCommandMap()
+
+	return conn
+}
+
+// Disconnect terminates the connection on behalf of an
+// operator KILL issued from either transport.  The victim
+// is told why, then its socket is closed so that the read
+// loop unblocks and serve() returns; without the close the
+// victim would keep a socket that looks alive but silently
+// delivers nothing.  Disconnect is called from the killer's
+// goroutine, never the victim's.
+//
+// The notify-and-close half runs on its own goroutine and
+// under a short deadline.  There is no per-client send
+// queue: send() writes straight to the victim's socket, so
+// a victim that has stopped reading would otherwise stall
+// the killer for the full writeTimeout on each of the two
+// writes -- wedging the operator's own serve() loop on the
+// IRC path, or the API request on the HTTP path.  Any
+// client could trigger that deliberately.  Disconnect
+// therefore returns as soon as the victim is marked closed;
+// the socket is closed shortly afterwards regardless of
+// whether the notification could be delivered.
+func (c *Conn) Disconnect(reason string) {
+	c.mu.Lock()
+
+	if c.closed {
+		c.mu.Unlock()
+
+		return
+	}
+
+	c.closed = true
+	c.killed = true
+	nick := c.nick
+	host := c.hostname
+	c.mu.Unlock()
+
+	if nick == "" {
+		nick = "*"
+	}
+
+	// Stop the relay goroutine, which would otherwise keep
+	// polling a queue belonging to a deleted session.
+	if c.cancel != nil {
+		c.cancel()
+	}
+
+	go c.notifyKilledAndClose(nick, host, reason)
+}
+
+// notifyKilledAndClose delivers the KILL and ERROR lines to
+// a killed victim and then closes its socket.  It runs on a
+// goroutine owned by neither the killer nor the victim, and
+// bounds both writes with killWriteWindow so an unresponsive
+// victim cannot hold the socket open indefinitely.
+func (c *Conn) notifyKilledAndClose(
+	nick, host, reason string,
+) {
+	defer c.conn.Close() //nolint:errcheck
+
+	c.sendWithin(
+		killWriteWindow,
+		FormatMessage(
+			c.serverSfx, irc.CmdKill, nick, reason,
+		),
+	)
+	c.sendWithin(
+		killWriteWindow,
+		"ERROR :Closing Link: "+host+
+			" ("+reason+")",
+	)
+}
+
+// buildCommandMap returns a map from IRC command strings
+// to handler functions.
+func (c *Conn) buildCommandMap() map[string]cmdHandler {
+	return map[string]cmdHandler{
+		irc.CmdPing: func(_ context.Context, msg *Message) {
+			c.handlePing(msg)
+		},
+		"PONG":         func(context.Context, *Message) {},
+		irc.CmdNick:    c.handleNick,
+		irc.CmdPrivmsg: c.handlePrivmsg,
+		irc.CmdNotice:  c.handlePrivmsg,
+		irc.CmdJoin:    c.handleJoin,
+		irc.CmdPart:    c.handlePart,
+		irc.CmdQuit: func(_ context.Context, msg *Message) {
+			c.handleQuit(msg)
+		},
+		irc.CmdTopic:  c.handleTopic,
+		irc.CmdMode:   c.handleMode,
+		irc.CmdNames:  c.handleNames,
+		irc.CmdList:   func(ctx context.Context, _ *Message) { c.handleList(ctx) },
+		irc.CmdWhois:  c.handleWhois,
+		irc.CmdWho:    c.handleWho,
+		irc.CmdLusers: func(ctx context.Context, _ *Message) { c.handleLusers(ctx) },
+		irc.CmdMotd:   func(context.Context, *Message) { c.deliverMOTD() },
+		irc.CmdOper:   c.handleOper,
+		irc.CmdAway:   c.handleAway,
+		irc.CmdKick:   c.handleKick,
+		irc.CmdPass:   c.handlePassPostReg,
+		"INVITE":      c.handleInvite,
+		"CAP": func(_ context.Context, msg *Message) {
+			c.handleCAP(msg)
+		},
+		"USERHOST":     c.handleUserhost,
+		irc.CmdVersion: func(context.Context, *Message) { c.handleVersion() },
+		irc.CmdAdmin:   func(context.Context, *Message) { c.handleAdmin() },
+		irc.CmdInfo:    func(context.Context, *Message) { c.handleInfo() },
+		irc.CmdTime:    func(context.Context, *Message) { c.handleTime() },
+		irc.CmdKill:    c.handleKillCmd,
+		irc.CmdWallops: c.handleWallopsCmd,
+	}
 }
 
 // resolveHost does a reverse DNS lookup, returning the IP
@@ -130,7 +263,7 @@ func (c *Conn) serve(ctx context.Context) {
 
 		c.handleMessage(ctx, msg)
 
-		if c.closed {
+		if c.isClosed() {
 			return
 		}
 	}
@@ -139,81 +272,65 @@ func (c *Conn) serve(ctx context.Context) {
 func (c *Conn) cleanup(ctx context.Context) {
 	c.mu.Lock()
 	wasRegistered := c.registered
+	wasKilled := c.killed
 	sessID := c.sessionID
 	nick := c.nick
 	c.closed = true
 	c.mu.Unlock()
 
 	if wasRegistered && sessID > 0 {
-		c.broadcastQuit(ctx, nick, "Connection closed")
+		c.svc.UnregisterWireConn(sessID, c)
-		c.database.DeleteSession(ctx, sessID) //nolint:errcheck,gosec
+
+		// A KILLed session has already been broadcast and
+		// deleted by the killer; broadcasting again would
+		// fan out a QUIT for a session row that is gone.
+		if !wasKilled {
+			c.svc.BroadcastQuit(
+				ctx, sessID, nick, "Connection closed",
+			)
+		}
 	}
 
 	c.conn.Close() //nolint:errcheck,gosec
 }
 
-func (c *Conn) broadcastQuit(
+// isClosed reports whether the connection has been marked
-	ctx context.Context,
+// for teardown, either by QUIT or by an operator KILL.
-	nick, reason string,
+func (c *Conn) isClosed() bool {
-) {
+	c.mu.Lock()
-	channels, err := c.database.GetSessionChannels(
+	defer c.mu.Unlock()
-		ctx, c.sessionID,
+
-	)
+	return c.closed
-	if err != nil {
-		return
 }
 
-	notified := make(map[int64]bool)
+// currentNick returns the connection's registered nick.
+// c.nick is written under c.mu during registration and
+// NICK changes, so every read must take the mutex.
+func (c *Conn) currentNick() string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
 
-	for _, ch := range channels {
+	return c.nick
-		chID, getErr := c.database.GetChannelByName(
-			ctx, ch.Name,
-		)
-		if getErr != nil {
-			continue
-		}
-
-		memberIDs, memErr := c.database.GetChannelMemberIDs(
-			ctx, chID,
-		)
-		if memErr != nil {
-			continue
-		}
-
-		for _, mid := range memberIDs {
-			if mid == c.sessionID || notified[mid] {
-				continue
-			}
-
-			notified[mid] = true
-		}
-	}
-
-	body, _ := json.Marshal([]string{reason}) //nolint:errchkjson
-
-	for sid := range notified {
-		dbID, _, insErr := c.database.InsertMessage(
-			ctx, irc.CmdQuit, nick, "", nil, body, nil,
-		)
-		if insErr != nil {
-			continue
-		}
-
-		_ = c.database.EnqueueToSession(ctx, sid, dbID)
-		c.brk.Notify(sid)
-	}
-
-	// Part from all channels so they get cleaned up.
-	for _, ch := range channels {
-		c.database.PartChannel(ctx, ch.ID, c.sessionID) //nolint:errcheck,gosec
-		c.database.DeleteChannelIfEmpty(ctx, ch.ID)     //nolint:errcheck,gosec
-	}
 }
 
 // send writes a formatted IRC line to the connection.
 func (c *Conn) send(line string) {
+	c.sendWithin(writeTimeout, line)
+}
+
+// sendWithin writes a formatted IRC line to the connection
+// under the given write deadline.  Callers that must not be
+// held hostage by an unresponsive peer pass a shorter window
+// than writeTimeout.
+func (c *Conn) sendWithin(
+	timeout time.Duration,
+	line string,
+) {
+	c.writeMu.Lock()
+	defer c.writeMu.Unlock()
+
 	_ = c.conn.SetWriteDeadline(
-		time.Now().Add(writeTimeout),
+		time.Now().Add(timeout),
 	)
 
 	_, _ = fmt.Fprintf(c.conn, "%s\r\n", line)
@@ -261,9 +378,8 @@ func (c *Conn) hostmask() string {
 	return c.nick + "!" + user + "@" + host
 }
 
-// handleMessage dispatches a parsed IRC message.
+// handleMessage dispatches a parsed IRC message using
-//
+// the command handler map.
-//nolint:cyclop // dispatch table is inherently branchy
 func (c *Conn) handleMessage(
 	ctx context.Context,
 	msg *Message,
@@ -276,57 +392,17 @@ func (c *Conn) handleMessage(
 		return
 	}
 
-	switch msg.Command {
+	handler, ok := c.commands[msg.Command]
-	case irc.CmdPing:
+	if !ok {
-		c.handlePing(msg)
-	case "PONG":
-		// Silently accept.
-	case irc.CmdNick:
-		c.handleNick(ctx, msg)
-	case irc.CmdPrivmsg, irc.CmdNotice:
-		c.handlePrivmsg(ctx, msg)
-	case irc.CmdJoin:
-		c.handleJoin(ctx, msg)
-	case irc.CmdPart:
-		c.handlePart(ctx, msg)
-	case irc.CmdQuit:
-		c.handleQuit(msg)
-	case irc.CmdTopic:
-		c.handleTopic(ctx, msg)
-	case irc.CmdMode:
-		c.handleMode(ctx, msg)
-	case irc.CmdNames:
-		c.handleNames(ctx, msg)
-	case irc.CmdList:
-		c.handleList(ctx)
-	case irc.CmdWhois:
-		c.handleWhois(ctx, msg)
-	case irc.CmdWho:
-		c.handleWho(ctx, msg)
-	case irc.CmdLusers:
-		c.handleLusers(ctx)
-	case irc.CmdMotd:
-		c.deliverMOTD()
-	case irc.CmdOper:
-		c.handleOper(ctx, msg)
-	case irc.CmdAway:
-		c.handleAway(ctx, msg)
-	case irc.CmdKick:
-		c.handleKick(ctx, msg)
-	case irc.CmdPass:
-		c.handlePassPostReg(ctx, msg)
-	case "INVITE":
-		c.handleInvite(ctx, msg)
-	case "CAP":
-		c.handleCAP(msg)
-	case "USERHOST":
-		c.handleUserhost(ctx, msg)
-	default:
 		c.sendNumeric(
 			irc.ErrUnknownCommand,
 			msg.Command, "Unknown command",
 		)
+
+		return
 	}
+
+	handler(ctx, msg)
 }
 
 // handlePreRegistration handles messages before the
@@ -435,7 +511,10 @@ func (c *Conn) completeRegistration(ctx context.Context) {
 			"failed to create session", "error", err,
 		)
 		c.send("ERROR :Internal server error")
+
+		c.mu.Lock()
 		c.closed = true
+		c.mu.Unlock()
 
 		return
 	}
@@ -446,6 +525,10 @@ func (c *Conn) completeRegistration(ctx context.Context) {
 	c.registered = true
 	c.mu.Unlock()
 
+	// Make this connection reachable by session ID so that
+	// KILL from either transport can disconnect it.
+	c.svc.RegisterWireConn(sessionID, c)
+
 	// If PASS was provided before registration, set the
 	// session password.
 	if c.passWord != "" && len(c.passWord) >= minPasswordLen {
@@ -484,7 +567,7 @@ func (c *Conn) deliverWelcome() {
 		"CHANTYPES=#",
 		"NICKLEN=32",
 		"PREFIX=(ov)@+",
-		"CHANMODES=,,H,mnst",
+		"CHANMODES=,,H,imnst",
 		"NETWORK="+c.serverSfx,
 		"are supported by this server",
 	)

internal/ircserver/conn_test.go

@@ -0,0 +1,128 @@
+package ircserver_test
+
+import (
+	"bufio"
+	"log/slog"
+	"net"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/ircserver"
+)
+
+// disconnectBudget is how long Disconnect is allowed to
+// take when the victim never reads.  It is far below the
+// 30s writeTimeout that the old synchronous implementation
+// would have burned on each of its two writes.
+const disconnectBudget = 2 * time.Second
+
+// TestDisconnectDoesNotBlockOnUnresponsiveVictim proves
+// that an operator KILL cannot be stalled by its target.
+// The victim's socket is a net.Pipe, so every write blocks
+// until the peer reads and the peer here never does.  The
+// old implementation performed both notification writes on
+// the killer's goroutine, which wedged the operator's own
+// serve() loop on the IRC path and the API request on the
+// HTTP path for as long as the victim cared to stay silent.
+func TestDisconnectDoesNotBlockOnUnresponsiveVictim(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	serverSide, clientSide := net.Pipe()
+
+	t.Cleanup(func() {
+		_ = clientSide.Close()
+	})
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
+	))
+	cfg := &config.Config{ //nolint:exhaustruct
+		ServerName: "test.irc",
+	}
+
+	victim := ircserver.NewTestConn(
+		log, cfg, serverSide, "victim",
+	)
+
+	returned := make(chan struct{})
+
+	go func() {
+		victim.Disconnect("killed by oper")
+		close(returned)
+	}()
+
+	select {
+	case <-returned:
+	case <-time.After(disconnectBudget):
+		t.Fatal(
+			"Disconnect blocked on the victim's socket; " +
+				"the killer must not be held hostage",
+		)
+	}
+}
+
+// TestDisconnectNotifiesAndClosesVictim is the other half
+// of the contract: moving the notification off the killer's
+// goroutine must not lose it.  A victim that does read gets
+// both the KILL and the ERROR line, and then its socket is
+// closed so its read loop unblocks.
+func TestDisconnectNotifiesAndClosesVictim(t *testing.T) {
+	t.Parallel()
+
+	serverSide, clientSide := net.Pipe()
+
+	t.Cleanup(func() {
+		_ = clientSide.Close()
+	})
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
+	))
+	cfg := &config.Config{ //nolint:exhaustruct
+		ServerName: "test.irc",
+	}
+
+	victim := ircserver.NewTestConn(
+		log, cfg, serverSide, "victim",
+	)
+
+	lines := make(chan []string, 1)
+
+	go func() {
+		var got []string
+
+		scanner := bufio.NewScanner(clientSide)
+		for scanner.Scan() {
+			got = append(got, scanner.Text())
+		}
+
+		lines <- got
+	}()
+
+	victim.Disconnect("killed by oper")
+
+	var got []string
+
+	select {
+	case got = <-lines:
+	case <-time.After(5 * time.Second):
+		t.Fatal("victim socket was never closed")
+	}
+
+	joined := strings.Join(got, "\n")
+
+	if !strings.Contains(joined, "KILL victim") {
+		t.Errorf("missing KILL line, got: %q", joined)
+	}
+
+	if !strings.Contains(joined, "ERROR :Closing Link:") {
+		t.Errorf("missing ERROR line, got: %q", joined)
+	}
+}

internal/ircserver/export_test.go

@@ -4,10 +4,13 @@ import (
 	"context"
 	"log/slog"
 	"net"
+	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/broker"
-	"git.eeqj.de/sneak/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/service"
 )
 
 // NewTestServer creates a Server suitable for testing.
@@ -18,11 +21,22 @@ func NewTestServer(
 	database *db.Database,
 	brk *broker.Broker,
 ) *Server {
+	globs := &globals.Globals{
+		Appname:   "neoirc",
+		Version:   "test",
+		StartTime: time.Now(),
+	}
+
+	svc := service.NewTestService(
+		database, brk, cfg, globs, log,
+	)
+
 	return &Server{ //nolint:exhaustruct
 		log:      log,
 		cfg:      cfg,
 		database: database,
 		brk:      brk,
+		svc:      svc,
 		conns:    make(map[*Conn]struct{}),
 	}
 }
@@ -41,3 +55,21 @@ func (s *Server) Stop() {
 func (s *Server) Listener() net.Listener {
 	return s.listener
 }
+
+// NewTestConn wraps an already-established net.Conn in a
+// Conn so tests can drive connection-level behaviour such
+// as Disconnect without standing up a whole server.
+func NewTestConn(
+	log *slog.Logger,
+	cfg *config.Config,
+	tcpConn net.Conn,
+	nick string,
+) *Conn {
+	conn := newConn(
+		context.Background(), tcpConn, log,
+		nil, nil, cfg, nil,
+	)
+	conn.nick = nick
+
+	return conn
+}

internal/ircserver/parser_test.go

@@ -3,7 +3,7 @@ package ircserver_test
 import (
 	"testing"
 
-	"git.eeqj.de/sneak/neoirc/internal/ircserver"
+	"sneak.berlin/go/neoirc/internal/ircserver"
 )
 
 //nolint:funlen // table-driven test

internal/ircserver/relay.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/pkg/irc"
+	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 // relayMessages polls the client output queue and delivers
@@ -120,6 +120,8 @@ func (c *Conn) deliverIRCMessage(
 		c.deliverKickMsg(msg, text)
 	case command == "INVITE":
 		c.deliverInviteMsg(msg, text)
+	case command == irc.CmdWallops:
+		c.deliverWallops(msg, text)
 	case command == irc.CmdMode:
 		c.deliverMode(msg, text)
 	case command == irc.CmdPing:
@@ -305,6 +307,18 @@ func (c *Conn) deliverInviteMsg(
 	c.sendFromServer("NOTICE", c.nick, text)
 }
 
+// deliverWallops sends a WALLOPS notification.
+func (c *Conn) deliverWallops(
+	msg *db.IRCMessage,
+	text string,
+) {
+	prefix := msg.From + "!" + msg.From + "@*"
+
+	c.send(FormatMessage(
+		prefix, irc.CmdWallops, text,
+	))
+}
+
 // deliverMode sends a MODE change notification.
 func (c *Conn) deliverMode(
 	msg *db.IRCMessage,

internal/ircserver/server.go

@@ -7,11 +7,12 @@ import (
 	"net"
 	"sync"
 
-	"git.eeqj.de/sneak/neoirc/internal/broker"
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/logger"
+	"sneak.berlin/go/neoirc/internal/service"
 )
 
 // Params defines the dependencies for creating an IRC
@@ -23,6 +24,7 @@ type Params struct {
 	Config   *config.Config
 	Database *db.Database
 	Broker   *broker.Broker
+	Service  *service.Service
 }
 
 // Server is the TCP IRC protocol server.
@@ -31,6 +33,7 @@ type Server struct {
 	cfg      *config.Config
 	database *db.Database
 	brk      *broker.Broker
+	svc      *service.Service
 	listener net.Listener
 	mu       sync.Mutex
 	conns    map[*Conn]struct{}
@@ -49,6 +52,7 @@ func New(
 		cfg:      params.Config,
 		database: params.Database,
 		brk:      params.Broker,
+		svc:      params.Service,
 		conns:    make(map[*Conn]struct{}),
 		listener: nil,
 		cancel:   nil,
@@ -133,7 +137,7 @@ func (s *Server) acceptLoop(ctx context.Context) {
 
 		client := newConn(
 			ctx, tcpConn, s.log,
-			s.database, s.brk, s.cfg,
+			s.database, s.brk, s.cfg, s.svc,
 		)
 
 		s.mu.Lock()

internal/ircserver/server_test.go

@@ -11,10 +11,10 @@ import (
 	"testing"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/broker"
-	"git.eeqj.de/sneak/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/ircserver"
+	"sneak.berlin/go/neoirc/internal/ircserver"
 
 	_ "modernc.org/sqlite"
 )
@@ -38,6 +38,99 @@ type testEnv struct {
 func newTestEnv(t *testing.T) *testEnv {
 	t.Helper()
 
+	return newTestEnvWithServerName(t, "test.irc")
+}
+
+// newTestEnvWithServerName creates a test environment with
+// an explicit SERVER_NAME. Passing "" exercises the shipped
+// default from config.go, under which the server must fall
+// back to "neoirc" rather than emitting an empty
+// server-name parameter.
+func newTestEnvWithServerName(
+	t *testing.T,
+	serverName string,
+) *testEnv {
+	t.Helper()
+
+	dsn := fmt.Sprintf(
+		"file:%s?mode=memory&cache=shared&_journal_mode=WAL",
+		t.Name(),
+	)
+
+	conn, err := sql.Open("sqlite", dsn)
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+
+	conn.SetMaxOpenConns(1)
+
+	_, err = conn.ExecContext(
+		t.Context(), "PRAGMA foreign_keys = ON",
+	)
+	if err != nil {
+		t.Fatalf("pragma: %v", err)
+	}
+
+	database := db.NewTestDatabaseFromConn(conn)
+
+	err = database.RunMigrations(t.Context())
+	if err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+
+	brk := broker.New()
+
+	cfg := &config.Config{ //nolint:exhaustruct
+		ServerName: serverName,
+		MOTD:       "Welcome to test IRC",
+	}
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	addr := listener.Addr().String()
+
+	err = listener.Close()
+	if err != nil {
+		t.Fatalf("close listener: %v", err)
+	}
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
+	))
+
+	srv := ircserver.NewTestServer(log, cfg, database, brk)
+
+	err = srv.Start(addr)
+	if err != nil {
+		t.Fatalf("start irc server: %v", err)
+	}
+
+	t.Cleanup(func() {
+		srv.Stop()
+
+		err := conn.Close()
+		if err != nil {
+			t.Logf("close db: %v", err)
+		}
+	})
+
+	return &testEnv{
+		database: database,
+		brk:      brk,
+		cfg:      cfg,
+		srv:      srv,
+	}
+}
+
+// newTestEnvWithOper creates a test environment with oper
+// credentials configured.
+func newTestEnvWithOper(t *testing.T) *testEnv {
+	t.Helper()
+
 	dsn := fmt.Sprintf(
 		"file:%s?mode=memory&cache=shared&_journal_mode=WAL",
 		t.Name(),
@@ -69,6 +162,8 @@ func newTestEnv(t *testing.T) *testEnv {
 	cfg := &config.Config{ //nolint:exhaustruct
 		ServerName:   "test.irc",
 		MOTD:         "Welcome to test IRC",
+		OperName:     "testoper",
+		OperPassword: "testpass",
 	}
 
 	listener, err := net.Listen("tcp", "127.0.0.1:0")
@@ -210,6 +305,36 @@ func (tc *testClient) register(nick string) []string {
 	})
 }
 
+// readUntilClosed reads until the peer closes the
+// connection, returning the lines received first.  It
+// fails the test if the connection is still open when the
+// read deadline expires, which is what a KILL that never
+// terminates the victim's socket looks like.
+func (tc *testClient) readUntilClosed() []string {
+	tc.t.Helper()
+
+	_ = tc.conn.SetReadDeadline(
+		time.Now().Add(testTimeout),
+	)
+
+	var lines []string
+
+	for tc.scanner.Scan() {
+		lines = append(lines, tc.scanner.Text())
+	}
+
+	err := tc.scanner.Err()
+	if err != nil {
+		tc.t.Fatalf(
+			"expected EOF on victim socket, got %v "+
+				"(lines: %v)",
+			err, lines,
+		)
+	}
+
+	return lines
+}
+
 // assertContains checks that at least one line matches the
 // given substring.
 func assertContains(
@@ -228,6 +353,27 @@ func assertContains(
 	t.Errorf("did not find %q in output: %s", substr, description)
 }
 
+// assertNotContains checks that no line matches the given
+// substring.
+func assertNotContains(
+	t *testing.T,
+	lines []string,
+	substr, description string,
+) {
+	t.Helper()
+
+	for _, line := range lines {
+		if strings.Contains(line, substr) {
+			t.Errorf(
+				"unexpectedly found %q in output: %s",
+				substr, description,
+			)
+
+			return
+		}
+	}
+}
+
 // joinAndDrain joins a channel and reads until
 // RPL_ENDOFNAMES.
 func (tc *testClient) joinAndDrain(channel string) {

internal/logger/logger.go

@@ -5,8 +5,8 @@ import (
 	"log/slog"
 	"os"
 
-	"git.eeqj.de/sneak/neoirc/internal/globals"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/globals"
 )
 
 // Params defines the dependencies for creating a Logger.

internal/middleware/middleware.go

@@ -7,9 +7,6 @@ import (
 	"net/http"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
 	basicauth "github.com/99designs/basicauth-go"
 	chimw "github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
@@ -18,6 +15,9 @@ import (
 	"github.com/slok/go-http-metrics/middleware/std"
 	"github.com/spf13/viper"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/logger"
 )
 
 const corsMaxAge = 300

internal/ratelimit/ratelimit_test.go

@@ -3,7 +3,7 @@ package ratelimit_test
 import (
 	"testing"
 
-	"git.eeqj.de/sneak/neoirc/internal/ratelimit"
+	"sneak.berlin/go/neoirc/internal/ratelimit"
 )
 
 func TestNewCreatesLimiter(t *testing.T) {

internal/server/routes.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/web"
+	"sneak.berlin/go/neoirc/web"
 
 	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/go-chi/chi/v5"

internal/server/server.go

@@ -12,12 +12,12 @@ import (
 	"syscall"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/handlers"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
-	"git.eeqj.de/sneak/neoirc/internal/middleware"
 	"go.uber.org/fx"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/handlers"
+	"sneak.berlin/go/neoirc/internal/logger"
+	"sneak.berlin/go/neoirc/internal/middleware"
 
 	"github.com/getsentry/sentry-go"
 	"github.com/go-chi/chi/v5"
@@ -45,7 +45,6 @@ type Params struct {
 // It manages routing, middleware, and lifecycle.
 type Server struct {
 	startupTime   time.Time
-	exitCode      int
 	sentryEnabled bool
 	log           *slog.Logger
 	ctx           context.Context //nolint:containedctx // signal handling pattern
@@ -71,7 +70,17 @@ func New(
 	lifecycle.Append(fx.Hook{
 		OnStart: func(_ context.Context) error {
 			srv.startupTime = time.Now()
-			go srv.Run() //nolint:contextcheck
+			// Configure, enable Sentry, and build the router
+			// synchronously so that srv.router is fully initialized
+			// before OnStart returns. Any HTTP traffic (including
+			// httptest harnesses that wrap srv as a handler) is
+			// therefore guaranteed to see an initialized router,
+			// eliminating the previous race between SetupRoutes
+			// and ServeHTTP.
+			srv.configure()
+			srv.enableSentry()
+			srv.SetupRoutes()
+			go srv.serve() //nolint:contextcheck
 
 			return nil
 		},
@@ -83,13 +92,6 @@ func New(
 	return srv, nil
 }
 
-// Run starts the server configuration, Sentry, and begins serving.
-func (srv *Server) Run() {
-	srv.configure()
-	srv.enableSentry()
-	srv.serve()
-}
-
 // ServeHTTP delegates to the chi router.
 func (srv *Server) ServeHTTP(
 	writer http.ResponseWriter,
@@ -127,7 +129,7 @@ func (srv *Server) enableSentry() {
 	srv.sentryEnabled = true
 }
 
-func (srv *Server) serve() int {
+func (srv *Server) serve() {
 	srv.ctx, srv.cancelFunc = context.WithCancel(
 		context.Background(),
 	)
@@ -152,8 +154,6 @@ func (srv *Server) serve() int {
 	<-srv.ctx.Done()
 
 	srv.cleanShutdown()
-
-	return srv.exitCode
 }
 
 func (srv *Server) cleanupForExit() {
@@ -161,8 +161,6 @@ func (srv *Server) cleanupForExit() {
 }
 
 func (srv *Server) cleanShutdown() {
-	srv.exitCode = 0
-
 	ctxShutdown, shutdownCancel := context.WithTimeout(
 		context.Background(), shutdownTimeout,
 	)
@@ -202,8 +200,6 @@ func (srv *Server) serveUntilShutdown() {
 		Handler:        srv,
 	}
 
-	srv.SetupRoutes()
-
 	srv.log.Info(
 		"http begin listen", "listenaddr", listenAddr,
 	)

internal/service/service_test.go

@@ -0,0 +1,814 @@
+// Tests use a global viper instance for configuration,
+// making parallel execution unsafe.
+//
+//nolint:paralleltest
+package service_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"go.uber.org/fx"
+	"go.uber.org/fx/fxtest"
+	"golang.org/x/crypto/bcrypt"
+	"sneak.berlin/go/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/logger"
+	"sneak.berlin/go/neoirc/internal/service"
+	"sneak.berlin/go/neoirc/pkg/irc"
+)
+
+func TestMain(m *testing.M) {
+	db.SetBcryptCost(bcrypt.MinCost)
+	os.Exit(m.Run())
+}
+
+// testEnv holds all dependencies for a service test.
+type testEnv struct {
+	svc    *service.Service
+	db     *db.Database
+	broker *broker.Broker
+	app    *fxtest.App
+}
+
+func newTestEnv(t *testing.T) *testEnv {
+	t.Helper()
+
+	dbURL := fmt.Sprintf(
+		"file:svc_test_%p?mode=memory&cache=shared",
+		t,
+	)
+
+	var (
+		database *db.Database
+		svc      *service.Service
+	)
+
+	brk := broker.New()
+
+	app := fxtest.New(t,
+		fx.Provide(
+			func() *globals.Globals {
+				return &globals.Globals{
+					Appname:   "neoirc-test",
+					Version:   "test",
+					StartTime: time.Now(),
+				}
+			},
+			logger.New,
+			func(
+				lifecycle fx.Lifecycle,
+				globs *globals.Globals,
+				log *logger.Logger,
+			) (*config.Config, error) {
+				cfg, err := config.New(
+					lifecycle, config.Params{ //nolint:exhaustruct
+						Globals: globs, Logger: log,
+					},
+				)
+				if err != nil {
+					return nil, fmt.Errorf(
+						"test config: %w", err,
+					)
+				}
+
+				cfg.DBURL = dbURL
+				cfg.Port = 0
+				cfg.OperName = "admin"
+				cfg.OperPassword = "secret"
+
+				return cfg, nil
+			},
+			func(
+				lifecycle fx.Lifecycle,
+				log *logger.Logger,
+				cfg *config.Config,
+			) (*db.Database, error) {
+				return db.New(lifecycle, db.Params{ //nolint:exhaustruct
+					Logger: log, Config: cfg,
+				})
+			},
+			func() *broker.Broker { return brk },
+			service.New,
+		),
+		fx.Populate(&database, &svc),
+	)
+
+	app.RequireStart()
+
+	t.Cleanup(func() {
+		app.RequireStop()
+	})
+
+	return &testEnv{
+		svc:    svc,
+		db:     database,
+		broker: brk,
+		app:    app,
+	}
+}
+
+// createSession is a test helper that creates a session
+// and returns the session ID.
+func createSession(
+	ctx context.Context,
+	t *testing.T,
+	database *db.Database,
+	nick string,
+) int64 {
+	t.Helper()
+
+	sessionID, _, _, err := database.CreateSession(
+		ctx, nick, nick, "localhost", "127.0.0.1",
+	)
+	if err != nil {
+		t.Fatalf("create session %s: %v", nick, err)
+	}
+
+	return sessionID
+}
+
+func TestFanOut(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := t.Context()
+
+	sid1 := createSession(ctx, t, env.db, "alice")
+	sid2 := createSession(ctx, t, env.db, "bob")
+
+	body, _ := json.Marshal([]string{"hello"}) //nolint:errchkjson
+
+	dbID, uuid, err := env.svc.FanOut(
+		ctx, irc.CmdPrivmsg, "alice", "#test",
+		nil, body, nil,
+		[]int64{sid1, sid2},
+	)
+	if err != nil {
+		t.Fatalf("FanOut: %v", err)
+	}
+
+	if dbID == 0 {
+		t.Error("expected non-zero dbID")
+	}
+
+	if uuid == "" {
+		t.Error("expected non-empty UUID")
+	}
+}
+
+func TestJoinChannel(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := t.Context()
+
+	sid := createSession(ctx, t, env.db, "alice")
+
+	result, err := env.svc.JoinChannel(
+		ctx, sid, "alice", "#general", "",
+	)
+	if err != nil {
+		t.Fatalf("JoinChannel: %v", err)
+	}
+
+	if result.ChannelID == 0 {
+		t.Error("expected non-zero channel ID")
+	}
+
+	if !result.IsCreator {
+		t.Error("first joiner should be creator")
+	}
+
+	// Second user joins — not creator.
+	sid2 := createSession(ctx, t, env.db, "bob")
+
+	result2, err := env.svc.JoinChannel(
+		ctx, sid2, "bob", "#general", "",
+	)
+	if err != nil {
+		t.Fatalf("JoinChannel bob: %v", err)
+	}
+
+	if result2.IsCreator {
+		t.Error("second joiner should not be creator")
+	}
+
+	if result2.ChannelID != result.ChannelID {
+		t.Error("both should join the same channel")
+	}
+}
+
+func TestPartChannel(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := t.Context()
+
+	sid := createSession(ctx, t, env.db, "alice")
+
+	_, err := env.svc.JoinChannel(
+		ctx, sid, "alice", "#general", "",
+	)
+	if err != nil {
+		t.Fatalf("JoinChannel: %v", err)
+	}
+
+	err = env.svc.PartChannel(
+		ctx, sid, "alice", "#general", "bye",
+	)
+	if err != nil {
+		t.Fatalf("PartChannel: %v", err)
+	}
+
+	// Parting a non-existent channel returns error.
+	err = env.svc.PartChannel(
+		ctx, sid, "alice", "#nonexistent", "",
+	)
+	if err == nil {
+		t.Error("expected error for non-existent channel")
+	}
+
+	var ircErr *service.IRCError
+	if !errors.As(err, &ircErr) {
+		t.Errorf("expected IRCError, got %T", err)
+	}
+}
+
+func TestSendChannelMessage(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := t.Context()
+
+	sid1 := createSession(ctx, t, env.db, "alice")
+	sid2 := createSession(ctx, t, env.db, "bob")
+
+	_, err := env.svc.JoinChannel(
+		ctx, sid1, "alice", "#chat", "",
+	)
+	if err != nil {
+		t.Fatalf("join alice: %v", err)
+	}
+
+	_, err = env.svc.JoinChannel(
+		ctx, sid2, "bob", "#chat", "",
+	)
+	if err != nil {
+		t.Fatalf("join bob: %v", err)
+	}
+
+	body, _ := json.Marshal([]string{"hello world"}) //nolint:errchkjson
+
+	dbID, uuid, err := env.svc.SendChannelMessage(
+		ctx, sid1, "alice",
+		irc.CmdPrivmsg, "#chat", body, nil,
+	)
+	if err != nil {
+		t.Fatalf("SendChannelMessage: %v", err)
+	}
+
+	if dbID == 0 {
+		t.Error("expected non-zero dbID")
+	}
+
+	if uuid == "" {
+		t.Error("expected non-empty UUID")
+	}
+
+	// Non-member cannot send.
+	sid3 := createSession(ctx, t, env.db, "charlie")
+
+	_, _, err = env.svc.SendChannelMessage(
+		ctx, sid3, "charlie",
+		irc.CmdPrivmsg, "#chat", body, nil,
+	)
+	if err == nil {
+		t.Error("expected error for non-member send")
+	}
+}
+
+func TestBroadcastQuit(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := t.Context()
+
+	sid1 := createSession(ctx, t, env.db, "alice")
+	sid2 := createSession(ctx, t, env.db, "bob")
+
+	_, err := env.svc.JoinChannel(
+		ctx, sid1, "alice", "#room", "",
+	)
+	if err != nil {
+		t.Fatalf("join alice: %v", err)
+	}
+
+	_, err = env.svc.JoinChannel(
+		ctx, sid2, "bob", "#room", "",
+	)
+	if err != nil {
+		t.Fatalf("join bob: %v", err)
+	}
+
+	// BroadcastQuit should not panic and should clean up.
+	env.svc.BroadcastQuit(
+		ctx, sid1, "alice", "Goodbye",
+	)
+
+	// Session should be deleted.
+	_, lookupErr := env.db.GetSessionByNick(ctx, "alice")
+	if lookupErr == nil {
+		t.Error("expected session to be deleted after quit")
+	}
+}
+
+func TestSendChannelMessage_Moderated(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := t.Context()
+
+	sid1 := createSession(ctx, t, env.db, "alice")
+	sid2 := createSession(ctx, t, env.db, "bob")
+
+	result, err := env.svc.JoinChannel(
+		ctx, sid1, "alice", "#modchat", "",
+	)
+	if err != nil {
+		t.Fatalf("join alice: %v", err)
+	}
+
+	_, err = env.svc.JoinChannel(
+		ctx, sid2, "bob", "#modchat", "",
+	)
+	if err != nil {
+		t.Fatalf("join bob: %v", err)
+	}
+
+	// Set channel to moderated.
+	chID := result.ChannelID
+	_ = env.svc.SetChannelFlag(ctx, chID, 'm', true)
+
+	body, _ := json.Marshal([]string{"test"}) //nolint:errchkjson
+
+	// Bob (non-op, non-voiced) should fail to send.
+	_, _, err = env.svc.SendChannelMessage(
+		ctx, sid2, "bob",
+		irc.CmdPrivmsg, "#modchat", body, nil,
+	)
+	if err == nil {
+		t.Error("expected error for non-voiced user in moderated channel")
+	}
+
+	// Alice (operator) should succeed.
+	_, _, err = env.svc.SendChannelMessage(
+		ctx, sid1, "alice",
+		irc.CmdPrivmsg, "#modchat", body, nil,
+	)
+	if err != nil {
+		t.Errorf("operator should be able to send in moderated channel: %v", err)
+	}
+}
+
+func TestQueryUserMode(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := t.Context()
+
+	sid := createSession(ctx, t, env.db, "alice")
+
+	// Fresh session has no modes.
+	modes, err := env.svc.QueryUserMode(ctx, sid)
+	if err != nil {
+		t.Fatalf("query user mode: %v", err)
+	}
+
+	if modes != "+" {
+		t.Errorf("expected +, got %s", modes)
+	}
+
+	// Set wallops.
+	_ = env.db.SetSessionWallops(ctx, sid, true)
+
+	modes, err = env.svc.QueryUserMode(ctx, sid)
+	if err != nil {
+		t.Fatalf("query user mode: %v", err)
+	}
+
+	if modes != "+w" {
+		t.Errorf("expected +w, got %s", modes)
+	}
+
+	// Set oper.
+	_ = env.db.SetSessionOper(ctx, sid, true)
+
+	modes, err = env.svc.QueryUserMode(ctx, sid)
+	if err != nil {
+		t.Fatalf("query user mode: %v", err)
+	}
+
+	if modes != "+ow" {
+		t.Errorf("expected +ow, got %s", modes)
+	}
+}
+
+// applyUserModeCaseState is the subset of session user-mode
+// state the rigorous TestApplyUserMode suite asserts on. It
+// mirrors the columns (oper, wallops) that the parser is
+// permitted to mutate.
+type applyUserModeCaseState struct {
+	oper    bool
+	wallops bool
+}
+
+// applyUserModeCase describes one rigor-suite case for
+// Service.ApplyUserMode: the pre-call DB state, the mode
+// string input, and the expected post-call observable state
+// (mode string on success, IRC error code on rejection, and
+// persisted session state either way).
+type applyUserModeCase struct {
+	name         string
+	initialState applyUserModeCaseState
+	modeStr      string
+	wantModes    string
+	wantErr      bool
+	wantErrCode  irc.IRCMessageType
+	wantState    applyUserModeCaseState
+}
+
+// applyUserModeCases returns every case listed in sneak's
+// review of PR #96 plus a few adjacent ones. Split across
+// helpers by category so each stays under funlen.
+func applyUserModeCases() []applyUserModeCase {
+	cases := applyUserModeHappyPathCases()
+	cases = append(cases, applyUserModeSignTransitionCases()...)
+	cases = append(cases, applyUserModeMalformedCases()...)
+	cases = append(cases, applyUserModeUnknownLetterCases()...)
+
+	return cases
+}
+
+// applyUserModeHappyPathCases covers valid single-char and
+// multi-char-without-sign-transition mode operations.
+func applyUserModeHappyPathCases() []applyUserModeCase {
+	return []applyUserModeCase{
+		{
+			name:         "+w from empty",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+w",
+			wantModes:    "+w",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: true},
+		},
+		{
+			name:         "-w from +w",
+			initialState: applyUserModeCaseState{oper: false, wallops: true},
+			modeStr:      "-w",
+			wantModes:    "+",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "-o from +o",
+			initialState: applyUserModeCaseState{oper: true, wallops: false},
+			modeStr:      "-o",
+			wantModes:    "+",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "-wo from +ow",
+			initialState: applyUserModeCaseState{oper: true, wallops: true},
+			modeStr:      "-wo",
+			wantModes:    "+",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+	}
+}
+
+// applyUserModeSignTransitionCases covers multi-char mode
+// strings where '+' and '-' flip partway through. +o is
+// never legal via MODE, so strings containing it must be
+// rejected atomically.
+func applyUserModeSignTransitionCases() []applyUserModeCase {
+	return []applyUserModeCase{
+		{
+			name:         "+w-o from +o",
+			initialState: applyUserModeCaseState{oper: true, wallops: false},
+			modeStr:      "+w-o",
+			wantModes:    "+w",
+			wantErr:      false,
+			wantErrCode:  0,
+			wantState:    applyUserModeCaseState{oper: false, wallops: true},
+		},
+		{
+			// +o is rejected before any op applies; wallops
+			// stays set.
+			name:         "-w+o always rejects +o",
+			initialState: applyUserModeCaseState{oper: true, wallops: true},
+			modeStr:      "-w+o",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: true, wallops: true},
+		},
+		{
+			// Wallops must NOT be cleared; oper must NOT be
+			// cleared. Rejection is fully atomic.
+			name:         "+o-w+w rejects because of +o",
+			initialState: applyUserModeCaseState{oper: true, wallops: true},
+			modeStr:      "+o-w+w",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: true, wallops: true},
+		},
+	}
+}
+
+// applyUserModeMalformedCases covers inputs that lack a
+// leading '+' or '-' and inputs that consist of bare signs
+// without mode letters. All must be rejected with no side
+// effects.
+func applyUserModeMalformedCases() []applyUserModeCase {
+	return []applyUserModeCase{
+		{
+			name:         "w no prefix rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "w",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			// Prove wallops is NOT cleared — the whole point
+			// of sneak's review.
+			name: "xw no prefix rejects (would have been" +
+				" silently -w before)",
+			initialState: applyUserModeCaseState{oper: false, wallops: true},
+			modeStr:      "xw",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: true},
+		},
+		{
+			name:         "empty string rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "bare + rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "bare - rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "-",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "+-+ rejects (no mode letters)",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+-+",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+	}
+}
+
+// applyUserModeUnknownLetterCases covers well-formed prefix
+// strings that contain unknown mode letters. Rejection must
+// be atomic: any valid letters before the invalid one must
+// not persist.
+func applyUserModeUnknownLetterCases() []applyUserModeCase {
+	return []applyUserModeCase{
+		{
+			name:         "-x+y rejects unknown -x",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "-x+y",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "+y-x rejects unknown +y",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+y-x",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name:         "+z unknown mode rejects",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+z",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			// Wallops must NOT be set.
+			name: "+wz rejects whole thing; +w side effect" +
+				" must NOT persist",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+wz",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+		{
+			name: "+wo rejects whole thing; +w side effect" +
+				" must NOT persist",
+			initialState: applyUserModeCaseState{oper: false, wallops: false},
+			modeStr:      "+wo",
+			wantModes:    "",
+			wantErr:      true,
+			wantErrCode:  irc.ErrUmodeUnknownFlag,
+			wantState:    applyUserModeCaseState{oper: false, wallops: false},
+		},
+	}
+}
+
+// TestApplyUserMode is the rigorous table-driven suite for
+// the shared user-mode parser. It covers every case listed
+// in sneak's review of PR #96 plus a few adjacent ones.
+// Each case asserts the resulting mode string AND the
+// persisted session state, to prove that rejected input
+// leaves no side effects.
+func TestApplyUserMode(t *testing.T) {
+	for _, testCase := range applyUserModeCases() {
+		t.Run(testCase.name, func(t *testing.T) {
+			runApplyUserModeCase(t, testCase)
+		})
+	}
+}
+
+// runApplyUserModeCase executes one applyUserModeCase: seed
+// the session state, invoke ApplyUserMode, and verify both
+// the returned value and the post-call persisted state.
+func runApplyUserModeCase(
+	t *testing.T, testCase applyUserModeCase,
+) {
+	t.Helper()
+
+	env := newTestEnv(t)
+	ctx := t.Context()
+	sid := createSession(ctx, t, env.db, "alice")
+
+	seedApplyUserModeState(ctx, t, env.db, sid, testCase.initialState)
+
+	result, err := env.svc.ApplyUserMode(
+		ctx, sid, testCase.modeStr,
+	)
+
+	verifyApplyUserModeOutcome(t, testCase, result, err)
+	verifyApplyUserModeState(ctx, t, env.db, sid, testCase.wantState)
+}
+
+// seedApplyUserModeState installs the pre-call session
+// state described by initialState.
+func seedApplyUserModeState(
+	ctx context.Context,
+	t *testing.T,
+	database *db.Database,
+	sid int64,
+	initialState applyUserModeCaseState,
+) {
+	t.Helper()
+
+	if initialState.oper {
+		if err := database.SetSessionOper(
+			ctx, sid, true,
+		); err != nil {
+			t.Fatalf("init oper: %v", err)
+		}
+	}
+
+	if initialState.wallops {
+		if err := database.SetSessionWallops(
+			ctx, sid, true,
+		); err != nil {
+			t.Fatalf("init wallops: %v", err)
+		}
+	}
+}
+
+// verifyApplyUserModeOutcome asserts the direct return
+// value of ApplyUserMode. It dispatches to the error- or
+// success-specific verifier based on wantErr.
+func verifyApplyUserModeOutcome(
+	t *testing.T,
+	testCase applyUserModeCase,
+	result string,
+	err error,
+) {
+	t.Helper()
+
+	if testCase.wantErr {
+		verifyApplyUserModeError(t, testCase, err)
+
+		return
+	}
+
+	verifyApplyUserModeSuccess(t, testCase, result, err)
+}
+
+// verifyApplyUserModeError checks that err is a
+// *service.IRCError whose code matches wantErrCode.
+func verifyApplyUserModeError(
+	t *testing.T, testCase applyUserModeCase, err error,
+) {
+	t.Helper()
+
+	var ircErr *service.IRCError
+	if !errors.As(err, &ircErr) {
+		t.Fatalf("expected IRCError, got %v", err)
+	}
+
+	if ircErr.Code != testCase.wantErrCode {
+		t.Errorf(
+			"code: want %d got %d",
+			testCase.wantErrCode, ircErr.Code,
+		)
+	}
+}
+
+// verifyApplyUserModeSuccess checks that err is nil and the
+// returned mode string matches wantModes.
+func verifyApplyUserModeSuccess(
+	t *testing.T,
+	testCase applyUserModeCase,
+	result string,
+	err error,
+) {
+	t.Helper()
+
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if result != testCase.wantModes {
+		t.Errorf(
+			"modes: want %q got %q",
+			testCase.wantModes, result,
+		)
+	}
+}
+
+// verifyApplyUserModeState asserts the post-call persisted
+// session state. This is the atomicity guarantee sneak
+// demanded: whether the call succeeded or was rejected, the
+// DB must match wantState exactly.
+func verifyApplyUserModeState(
+	ctx context.Context,
+	t *testing.T,
+	database *db.Database,
+	sid int64,
+	wantState applyUserModeCaseState,
+) {
+	t.Helper()
+
+	gotOper, err := database.IsSessionOper(ctx, sid)
+	if err != nil {
+		t.Fatalf("read oper: %v", err)
+	}
+
+	gotWallops, err := database.IsSessionWallops(ctx, sid)
+	if err != nil {
+		t.Fatalf("read wallops: %v", err)
+	}
+
+	if gotOper != wantState.oper {
+		t.Errorf(
+			"oper: want %v got %v",
+			wantState.oper, gotOper,
+		)
+	}
+
+	if gotWallops != wantState.wallops {
+		t.Errorf(
+			"wallops: want %v got %v",
+			wantState.wallops, gotWallops,
+		)
+	}
+}

internal/stats/stats_test.go

@@ -3,7 +3,7 @@ package stats_test
 import (
 	"testing"
 
-	"git.eeqj.de/sneak/neoirc/internal/stats"
+	"sneak.berlin/go/neoirc/internal/stats"
 )
 
 func TestNew(t *testing.T) {

pkg/irc/commands.go

@@ -2,10 +2,13 @@ package irc
 
 // IRC command names (RFC 1459 / RFC 2812).
 const (
+	CmdAdmin    = "ADMIN"
 	CmdAway     = "AWAY"
+	CmdInfo     = "INFO"
 	CmdInvite   = "INVITE"
 	CmdJoin     = "JOIN"
 	CmdKick     = "KICK"
+	CmdKill     = "KILL"
 	CmdList     = "LIST"
 	CmdLusers   = "LUSERS"
 	CmdMode     = "MODE"
@@ -20,8 +23,12 @@ const (
 	CmdPong     = "PONG"
 	CmdPrivmsg  = "PRIVMSG"
 	CmdQuit     = "QUIT"
+	CmdTime     = "TIME"
 	CmdTopic    = "TOPIC"
 	CmdUser     = "USER"
+	CmdUserhost = "USERHOST"
+	CmdVersion  = "VERSION"
+	CmdWallops  = "WALLOPS"
 	CmdWho      = "WHO"
 	CmdWhois    = "WHOIS"
 )

pkg/irc/numerics_test.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"testing"
 
-	"git.eeqj.de/sneak/neoirc/pkg/irc"
+	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 func TestName(t *testing.T) {

schema/commands/JOIN.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/JOIN.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/JOIN.json",
   "title": "JOIN",
   "description": "Join a channel. C2S: request to join. S2C: notification that a user joined. RFC 1459 §4.2.1.",
   "$ref": "../message.json",

schema/commands/KICK.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/KICK.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/KICK.json",
   "title": "KICK",
   "description": "Kick a user from a channel. RFC 1459 §4.2.8.",
   "$ref": "../message.json",

schema/commands/MODE.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/MODE.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/MODE.json",
   "title": "MODE",
   "description": "Set or query channel/user modes. RFC 1459 §4.2.3.",
   "$ref": "../message.json",

schema/commands/NICK.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/NICK.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/NICK.json",
   "title": "NICK",
   "description": "Change nickname. C2S: request new nick. S2C: notification of nick change. RFC 1459 §4.1.2.",
   "$ref": "../message.json",

schema/commands/NOTICE.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/NOTICE.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/NOTICE.json",
   "title": "NOTICE",
   "description": "Send a notice. Like PRIVMSG but must not trigger automatic replies. RFC 1459 §4.4.2.",
   "$ref": "../message.json",

schema/commands/PART.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PART.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/PART.json",
   "title": "PART",
   "description": "Leave a channel. C2S: request to leave. S2C: notification that a user left. RFC 1459 §4.2.2.",
   "$ref": "../message.json",

schema/commands/PING.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PING.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/PING.json",
   "title": "PING",
   "description": "Keepalive. C2S or S2S. Server responds with PONG. RFC 1459 §4.6.2.",
   "$ref": "../message.json",

schema/commands/PONG.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PONG.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/PONG.json",
   "title": "PONG",
   "description": "Keepalive response. S2C or S2S. RFC 1459 §4.6.3.",
   "$ref": "../message.json",

schema/commands/PRIVMSG.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PRIVMSG.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/PRIVMSG.json",
   "title": "PRIVMSG",
   "description": "Send a message to a channel or user. C2S: client sends to server. S2C: server relays to recipients. RFC 1459 §4.4.1.",
   "$ref": "../message.json",

schema/commands/PUBKEY.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PUBKEY.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/PUBKEY.json",
   "title": "PUBKEY",
   "description": "Announce or relay a user's public signing key. C2S: client announces key to channel or server. S2C: server relays to channel members. Protocol extension (not in RFC 1459). Body is a structured object (not an array) containing the key material.",
   "$ref": "../message.json",

schema/commands/QUIT.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/QUIT.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/QUIT.json",
   "title": "QUIT",
   "description": "User disconnected. S2C only. RFC 1459 §4.1.6.",
   "$ref": "../message.json",

schema/commands/TOPIC.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/TOPIC.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/TOPIC.json",
   "title": "TOPIC",
   "description": "Get or set channel topic. C2S: set topic (body present) or query (body absent). S2C: topic change notification. RFC 1459 §4.2.4.",
   "$ref": "../message.json",

schema/message.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/message.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/message.json",
   "title": "IRC Message Envelope",
   "description": "Base envelope for all messages. Mirrors IRC wire format (RFC 1459/2812) encoded as JSON over HTTP. The 'command' field carries either an IRC command name (PRIVMSG, JOIN, etc.) or a three-digit numeric reply code (001, 353, 433, etc.).",
   "type": "object",

schema/numerics/001.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/001.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/001.json",
   "title": "001 RPL_WELCOME",
   "description": "Welcome message sent after successful session creation. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",

schema/numerics/002.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/002.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/002.json",
   "title": "002 RPL_YOURHOST",
   "description": "Server host info sent after session creation. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",

schema/numerics/003.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/003.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/003.json",
   "title": "003 RPL_CREATED",
   "description": "Server creation date. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",

schema/numerics/004.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/004.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/004.json",
   "title": "004 RPL_MYINFO",
   "description": "Server info (name, version, available modes). RFC 2812 \u00a75.1.",
   "$ref": "../message.json",

schema/numerics/322.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/322.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/322.json",
   "title": "322 RPL_LIST",
   "description": "Channel list entry. One per channel in response to LIST. RFC 1459 \u00a76.2.",
   "$ref": "../message.json",

schema/numerics/323.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/323.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/323.json",
   "title": "323 RPL_LISTEND",
   "description": "End of channel list. RFC 1459 \u00a76.2.",
   "$ref": "../message.json",

schema/numerics/332.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/332.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/332.json",
   "title": "332 RPL_TOPIC",
   "description": "Channel topic (sent on JOIN or TOPIC query). RFC 1459 \u00a76.2.",
   "$ref": "../message.json",

schema/numerics/353.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/353.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/353.json",
   "title": "353 RPL_NAMREPLY",
   "description": "Channel member list. Sent on JOIN or NAMES query. RFC 1459 \u00a76.2.",
   "$ref": "../message.json",

schema/numerics/366.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/366.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/366.json",
   "title": "366 RPL_ENDOFNAMES",
   "description": "End of NAMES list. RFC 1459 \u00a76.2.",
   "$ref": "../message.json",

schema/numerics/372.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/372.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/372.json",
   "title": "372 RPL_MOTD",
   "description": "MOTD line. One message per line of the MOTD. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",

schema/numerics/375.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/375.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/375.json",
   "title": "375 RPL_MOTDSTART",
   "description": "Start of MOTD. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",

schema/numerics/376.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/376.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/376.json",
   "title": "376 RPL_ENDOFMOTD",
   "description": "End of MOTD. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",

schema/numerics/401.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/401.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/401.json",
   "title": "401 ERR_NOSUCHNICK",
   "description": "No such nick/channel. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",

schema/numerics/403.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/403.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/403.json",
   "title": "403 ERR_NOSUCHCHANNEL",
   "description": "No such channel. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",

schema/numerics/433.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/433.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/433.json",
   "title": "433 ERR_NICKNAMEINUSE",
   "description": "Nickname is already in use. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",

schema/numerics/442.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/442.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/442.json",
   "title": "442 ERR_NOTONCHANNEL",
   "description": "You're not on that channel. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",

schema/numerics/482.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/482.json",
+  "$id": "https://sneak.berlin/go/neoirc/schema/numerics/482.json",
   "title": "482 ERR_CHANOPRIVSNEEDED",
   "description": "You're not channel operator. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",