=head1 Fine grained operator privileges

Terminology:

=over

=item IRCop

user with user mode +o, usually obtained with /oper
users whose operator status is indicated by a different user mode
than +o, or whose user mode +o is not propagated to other servers,
are not IRCops from ermyth's point of view

=item operclass

group of privileges defined in an operclass{} block in ermyth.conf

=item config services operator

user logged into an account named in an operator{} block in
ermyth.conf

=item services operator

user logged into an account named in an operator{} block in
ermyth.conf or an account granted privileges with /os soper

=back

Note that an account cannot have both an operator{} block and privileges
granted with /os soper. If this happens, the privileges from /os soper
will be discarded.

A few privileges are granted independently of operclasses:

=over

=item To all IRCops and services operators (has_any_priv()):

more detailed "not authorized" messages telling which priv they are
missing, ability to use /os help

=item To all config services operators:

account does not expire (unlike HOLD, registered channels do);
this is to avoid someone else registering the account and taking
the privs

=item To all services operators:

operations like drop, sendpass and return are restricted

=back

All IRCops get the privileges in the "ircop" operclass. Services operators
get the privileges in the operclass in their operator{} block or the
operclass set with /os soper. However, if the operclass has the needoper
flag set, privileges are only granted to IRC users if they are IRCops. If
both conditions apply, the union of the privileges is granted.

The OperServ SPECS command shows the privileges granted to an online user
or operclass, in a somewhat wordy format. /stats o and SOPER LIST show all
services operators. SOPER LISTCLASS shows all operclasses.

Description of the privileges in operclasses:

=over

=item special:ircop

bound to AC_IRCOP, if you still have modules using that

=item user:auspex

see the invisible about user registrations,
ns/us info/list mainly
also allows searching information about online users,
os rnc/rmatch/rwatch

=item user:admin

administer users

=item user:sendpass

send user passwords to their email addresses

=item user:vhost

set vhosts

=item user:fregister

use /ns fregister (contrib module) to register accounts on behalf of
someone else

=item chan:auspex

see the invisible about channels and channel registrations,
cs info/list/flags, ns/us listchans, os compare mainly

=item chan:admin

administer channels

=item chan:cmodes

change oper-only cmodes in mode locks (but only on own channels)

=item chan:joinstaffonly

join channels set staffonly

=item user:mark

use ns/us/cs mark and override marks

=item user:hold

use ns/us/cs hold to prevent things from expiring

=item user:regnolimit

exempt from limits on numbers of registrations (does not work
fully if set on the ircop operclass)

=item general:auspex

see general information about services: most privileged /stats,
/trace, /os modinspect, /os modlist, /os uptime
the idea is that this does not violate user privacy

=item general:viewprivs

see all operator{} blocks, see the privs users and operclasses have:
/stats o, /os specs

=item general:flood

exempt from services flood control (general::flood* in ermyth.conf)

=item general:metadata

mess with private metadata (but only on own accounts and channels)

=item general:admin

restart/shutdown/rehash services, load modules, use raw/inject (if
globally allowed in ermyth.conf), resetpass/sendpass on accounts
with operator{} blocks


=item operserv:omode

use /os mode

=item operserv:akill

use /os akill and /stats k

=item operserv:massakill

do mass kills and akills on channels and regular expressions
os clearchan/rakill/rwatch
this also needs chan:admin or user:auspex depending on the command

=item operserv:jupe

use /os jupe

=item operserv:noop

use /os noop

=item operserv:global

send global notices

=item operserv:grant

use /os soper add/del