feat(leveva-iauth): native async auth crate + ident module (P11 slice 39)
Subsume the standalone iauth daemon into leveva as an in-process async crate:
the separate process + pipe protocol only existed to keep slow auth probes off
the C ircd's single-threaded select loop, which tokio makes moot.
leveva-iauth ships the framework — a clean Module async trait, ModuleCtx (peer
IP + ports), ModuleOutcome (NoOpinion/Username/Deny), and an AuthPipeline that
runs the configured modules under a per-module timeout and folds them into an
AuthVerdict — plus the first module, ident (RFC 1413). Ident only ever provides
a username (never denies); the denying modules (dnsbl/socks/webproxy/pipe) and
their 465 gate are later slices, and DNS work lands with hickory-dns then.
Tested: 17 unit (pure parse_ident_reply happy + every rejection branch; the
async module vs a fake identd incl. no-listener and malformed-reply; pipeline
first-username-wins, deny short-circuit, hang→timeout) + a 4-property fuzz
(parser panic-freedom on arbitrary bytes/text, well-formed round-trip,
port-mismatch rejection). clippy clean.
feat(leveva-iauth): native async auth crate + ident module (P11 slice 39)
Subsume the standalone iauth daemon into leveva as an in-process async crate:
the separate process + pipe protocol only existed to keep slow auth probes off
the C ircd's single-threaded select loop, which tokio makes moot.
leveva-iauth ships the framework — a clean Module async trait, ModuleCtx (peer
IP + ports), ModuleOutcome (NoOpinion/Username/Deny), and an AuthPipeline that
runs the configured modules under a per-module timeout and folds them into an
AuthVerdict — plus the first module, ident (RFC 1413). Ident only ever provides
a username (never denies); the denying modules (dnsbl/socks/webproxy/pipe) and
their 465 gate are later slices, and DNS work lands with hickory-dns then.
Tested: 17 unit (pure parse_ident_reply happy + every rejection branch; the
async module vs a fake identd incl. no-listener and malformed-reply; pipeline
first-username-wins, deny short-circuit, hang→timeout) + a 4-property fuzz
(parser panic-freedom on arbitrary bytes/text, well-formed round-trip,
port-mismatch rejection). clippy clean.
xeiaso.net