feat: add password protection for channels

- Updated IChatService to include password parameter in JoinChannelAsync method.
- Modified ChannelDto and related models to support password functionality.
- Implemented password handling in ChannelService for channel creation and membership validation.
- Enhanced IrcCommandHandler to manage channel join requests with passwords.
- Added ChannelPasswordDialog for user input when joining protected channels.
- Created database migration to add PasswordHash column to Channels table.
- Updated tests to cover new password functionality in channel joining and management.

src/EchoHub.Server/Controllers/ChannelsController.cs

@@ -65,7 +65,7 @@ public class ChannelsController : ControllerBase
             return Unauthorized(new ErrorResponse("Authentication required."));
 
         var result = await _channelService.CreateChannelAsync(
-            Guid.Parse(userIdClaim), request.Name, request.Topic, request.IsPublic);
+            Guid.Parse(userIdClaim), request.Name, request.Topic, request.IsPublic, request.Password);
         if (!result.IsSuccess)
             return MapChannelError(result);
 

src/EchoHub.Server/Data/EchoHubDbContext.cs

@@ -44,6 +44,7 @@ public class EchoHubDbContext : DbContext
             entity.HasIndex(c => c.Name).IsUnique();
             entity.Property(c => c.Name).IsRequired().HasMaxLength(100);
             entity.Property(c => c.Topic).HasMaxLength(500);
+            entity.Property(c => c.PasswordHash).HasMaxLength(100);
 
             entity.HasMany(c => c.Messages)
                   .WithOne(m => m.Channel)

src/EchoHub.Server/Data/Migrations/20260715232856_AddChannelPasswordHash.Designer.cs

@@ -0,0 +1,271 @@
+// <auto-generated />
+using System;
+using EchoHub.Server.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    [DbContext(typeof(EchoHubDbContext))]
+    [Migration("20260715232856_AddChannelPasswordHash")]
+    partial class AddChannelPasswordHash
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.3");
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<Guid>("CreatedByUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsPublic")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PasswordHash")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Topic")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Channels");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("JoinedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("UserId", "ChannelId");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ChannelMemberships");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentFileName")
+                        .HasMaxLength(255)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long?>("AttachmentFileSize")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("AttachmentUrl")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasMaxLength(16000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EmbedJson")
+                        .HasMaxLength(32000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("SenderUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("SenderUsername")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("SentAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Type")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("SentAt");
+
+                    b.ToTable("Messages");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("ExpiresAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("RevokedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AvatarAscii")
+                        .HasMaxLength(10000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Bio")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("DisplayName")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<bool>("IsMuted")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("LastSeenAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("MutedUntil")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("NicknameColor")
+                        .HasMaxLength(7)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("StatusMessage")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", null)
+                        .WithMany()
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("EchoHub.Core.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", "Channel")
+                        .WithMany("Messages")
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Channel");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.User", "User")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Navigation("Messages");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260715232856_AddChannelPasswordHash.cs

@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddChannelPasswordHash : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "PasswordHash",
+                table: "Channels",
+                type: "TEXT",
+                maxLength: 100,
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "PasswordHash",
+                table: "Channels");
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/EchoHubDbContextModelSnapshot.cs

@@ -37,6 +37,10 @@ namespace EchoHub.Server.Data.Migrations
                         .HasMaxLength(100)
                         .HasColumnType("TEXT");
 
+                    b.Property<string>("PasswordHash")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
                     b.Property<string>("Topic")
                         .HasMaxLength(500)
                         .HasColumnType("TEXT");

src/EchoHub.Server/Hubs/ChatHub.cs

@@ -56,15 +56,15 @@ public class ChatHub : Hub<IEchoHubClient>
         }
     }
 
-    public async Task<JoinChannelResult> JoinChannel(string channelName)
+    public async Task<JoinChannelResult> JoinChannel(string channelName, string? password = null)
     {
         try
         {
-            var (history, error) = await _chatService.JoinChannelAsync(
-                Context.ConnectionId, CurrentUserId, CurrentUsername, channelName);
+            var (history, error, passwordRequired) = await _chatService.JoinChannelAsync(
+                Context.ConnectionId, CurrentUserId, CurrentUsername, channelName, password);
 
             if (error is not null)
-                return new JoinChannelResult(false, [], error);
+                return new JoinChannelResult(false, [], error, passwordRequired);
 
             await Groups.AddToGroupAsync(Context.ConnectionId, channelName.ToLowerInvariant().Trim());
             return new JoinChannelResult(true, history);

src/EchoHub.Server/Services/ChannelService.cs

@@ -41,14 +41,14 @@ public class ChannelService : IChannelService
             .Skip(offset)
             .Take(limit)
             .Select(c => new ChannelDto(
-                c.Id, c.Name, c.Topic, c.IsPublic, c.Messages.Count, c.CreatedAt))
+                c.Id, c.Name, c.Topic, c.IsPublic, c.Messages.Count, c.CreatedAt, c.PasswordHash != null))
             .ToListAsync();
 
         return new PaginatedResponse<ChannelDto>(channels, total, offset, limit);
     }
 
     public async Task<ChannelOperationResult> CreateChannelAsync(
-        Guid creatorUserId, string name, string? topic, bool isPublic)
+        Guid creatorUserId, string name, string? topic, bool isPublic, string? password = null)
     {
         if (string.IsNullOrWhiteSpace(name))
             return ChannelOperationResult.Fail(ChannelError.ValidationFailed, "Channel name is required.");
@@ -59,6 +59,10 @@ public class ChannelService : IChannelService
             return ChannelOperationResult.Fail(ChannelError.ValidationFailed,
                 "Channel name must be 2-100 characters and contain only letters, digits, underscores, or hyphens.");
 
+        var passwordError = ValidateChannelPassword(ref password);
+        if (passwordError is not null)
+            return ChannelOperationResult.Fail(ChannelError.ValidationFailed, passwordError);
+
         using var scope = _scopeFactory.CreateScope();
         var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
 
@@ -72,6 +76,7 @@ public class ChannelService : IChannelService
             Topic = topic?.Trim(),
             IsPublic = isPublic,
             CreatedByUserId = creatorUserId,
+            PasswordHash = password is not null ? BCrypt.Net.BCrypt.HashPassword(password) : null,
         };
 
         db.Channels.Add(channel);
@@ -85,7 +90,8 @@ public class ChannelService : IChannelService
 
         await db.SaveChangesAsync();
 
-        var dto = new ChannelDto(channel.Id, channel.Name, channel.Topic, channel.IsPublic, 0, channel.CreatedAt);
+        var dto = new ChannelDto(channel.Id, channel.Name, channel.Topic, channel.IsPublic, 0, channel.CreatedAt,
+            channel.PasswordHash != null);
         return ChannelOperationResult.Success(dto);
     }
 
@@ -112,7 +118,40 @@ public class ChannelService : IChannelService
         await db.SaveChangesAsync();
 
         var messageCount = await db.Messages.CountAsync(m => m.ChannelId == dbChannel.Id);
-        var dto = new ChannelDto(dbChannel.Id, dbChannel.Name, dbChannel.Topic, dbChannel.IsPublic, messageCount, dbChannel.CreatedAt);
+        var dto = new ChannelDto(dbChannel.Id, dbChannel.Name, dbChannel.Topic, dbChannel.IsPublic, messageCount, dbChannel.CreatedAt,
+            dbChannel.PasswordHash != null);
+        return ChannelOperationResult.Success(dto);
+    }
+
+    /// <summary>
+    /// Sets, changes, or clears (null) a channel's join password. Creator or admin only.
+    /// </summary>
+    public async Task<ChannelOperationResult> SetChannelPasswordAsync(Guid callerUserId, string channelName, string? password)
+    {
+        channelName = channelName.ToLowerInvariant().Trim();
+
+        var passwordError = ValidateChannelPassword(ref password);
+        if (passwordError is not null)
+            return ChannelOperationResult.Fail(ChannelError.ValidationFailed, passwordError);
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var dbChannel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        if (dbChannel is null)
+            return ChannelOperationResult.Fail(ChannelError.NotFound, $"Channel '{channelName}' does not exist.");
+
+        var caller = await db.Users.FindAsync(callerUserId);
+        if (dbChannel.CreatedByUserId != callerUserId && (caller is null || caller.Role < ServerRole.Admin))
+            return ChannelOperationResult.Fail(ChannelError.Forbidden,
+                "Only the channel creator or an admin can change the channel password.");
+
+        dbChannel.PasswordHash = password is not null ? BCrypt.Net.BCrypt.HashPassword(password) : null;
+        await db.SaveChangesAsync();
+
+        var messageCount = await db.Messages.CountAsync(m => m.ChannelId == dbChannel.Id);
+        var dto = new ChannelDto(dbChannel.Id, dbChannel.Name, dbChannel.Topic, dbChannel.IsPublic, messageCount, dbChannel.CreatedAt,
+            dbChannel.PasswordHash != null);
         return ChannelOperationResult.Success(dto);
     }
 
@@ -139,7 +178,8 @@ public class ChannelService : IChannelService
         db.Channels.Remove(dbChannel);
         await db.SaveChangesAsync();
 
-        var dto = new ChannelDto(dbChannel.Id, dbChannel.Name, dbChannel.Topic, dbChannel.IsPublic, 0, dbChannel.CreatedAt);
+        var dto = new ChannelDto(dbChannel.Id, dbChannel.Name, dbChannel.Topic, dbChannel.IsPublic, 0, dbChannel.CreatedAt,
+            dbChannel.PasswordHash != null);
         return ChannelOperationResult.Success(dto);
     }
 
@@ -165,7 +205,8 @@ public class ChannelService : IChannelService
 
         return channels.Select(c => new ChannelListItem(
             c.Name, c.Topic,
-            _presenceTracker.GetOnlineUsersInChannel(c.Name).Count)).ToList();
+            _presenceTracker.GetOnlineUsersInChannel(c.Name).Count,
+            c.IsPublic, c.PasswordHash != null)).ToList();
     }
 
     public async Task<ChannelDto?> GetChannelByNameAsync(string channelName)
@@ -179,15 +220,16 @@ public class ChannelService : IChannelService
         if (c is null) return null;
 
         var messageCount = await db.Messages.CountAsync(m => m.ChannelId == c.Id);
-        return new ChannelDto(c.Id, c.Name, c.Topic, c.IsPublic, messageCount, c.CreatedAt);
+        return new ChannelDto(c.Id, c.Name, c.Topic, c.IsPublic, messageCount, c.CreatedAt, c.PasswordHash != null);
     }
 
-    public async Task<(bool Success, string? Error)> EnsureChannelMembershipAsync(Guid userId, string channelName)
+    public async Task<(bool Success, string? Error, bool PasswordRequired)> EnsureChannelMembershipAsync(
+        Guid userId, string channelName, string? password = null)
     {
         channelName = channelName.ToLowerInvariant().Trim();
 
         if (!ValidationConstants.ChannelNameRegex().IsMatch(channelName))
-            return (false, "Invalid channel name. Use 2-100 characters: letters, digits, underscores, or hyphens.");
+            return (false, "Invalid channel name. Use 2-100 characters: letters, digits, underscores, or hyphens.", false);
 
         using var scope = _scopeFactory.CreateScope();
         var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
@@ -211,7 +253,7 @@ public class ChannelService : IChannelService
             }
             else
             {
-                return (false, $"Channel '{channelName}' does not exist. Create it first via the channel list.");
+                return (false, $"Channel '{channelName}' does not exist. Create it first via the channel list.", false);
             }
         }
 
@@ -219,6 +261,17 @@ public class ChannelService : IChannelService
             .AnyAsync(m => m.UserId == userId && m.ChannelId == channel.Id);
         if (!hasMembership)
         {
+            // Password gate: existing members (incl. the creator) joined before, so only
+            // first-time joins of a protected channel need the password.
+            if (channel.PasswordHash is not null)
+            {
+                if (string.IsNullOrEmpty(password))
+                    return (false, $"Channel '{channelName}' is password protected.", true);
+
+                if (!BCrypt.Net.BCrypt.Verify(password, channel.PasswordHash))
+                    return (false, $"Incorrect password for channel '{channelName}'.", true);
+            }
+
             db.ChannelMemberships.Add(new ChannelMembership
             {
                 UserId = userId,
@@ -227,7 +280,28 @@ public class ChannelService : IChannelService
             await db.SaveChangesAsync();
         }
 
-        return (true, null);
+        return (true, null, false);
+    }
+
+    /// <summary>
+    /// Normalizes and validates a channel password. Whitespace-only becomes null (no password).
+    /// Returns an error message, or null when valid.
+    /// </summary>
+    private static string? ValidateChannelPassword(ref string? password)
+    {
+        if (string.IsNullOrWhiteSpace(password))
+        {
+            password = null;
+            return null;
+        }
+
+        if (password.Length < ValidationConstants.MinChannelPasswordLength)
+            return $"Channel password must be at least {ValidationConstants.MinChannelPasswordLength} characters.";
+
+        if (password.Length > ValidationConstants.MaxPasswordLength)
+            return $"Channel password must not exceed {ValidationConstants.MaxPasswordLength} characters.";
+
+        return null;
     }
 
     private static async Task EnsureDefaultChannelAsync(EchoHubDbContext db)

src/EchoHub.Server/Services/ChatService.cs

@@ -93,15 +93,15 @@ public class ChatService : IChatService
         return username;
     }
 
-    public async Task<(List<MessageDto> History, string? Error)> JoinChannelAsync(
-        string connectionId, Guid userId, string username, string channelName)
+    public async Task<(List<MessageDto> History, string? Error, bool PasswordRequired)> JoinChannelAsync(
+        string connectionId, Guid userId, string username, string channelName, string? password = null)
     {
         channelName = channelName.ToLowerInvariant().Trim();
 
-        // Delegate channel validation + membership to ChannelService
-        var (success, error) = await _channelService.EnsureChannelMembershipAsync(userId, channelName);
+        // Delegate channel validation + membership (incl. password gate) to ChannelService
+        var (success, error, passwordRequired) = await _channelService.EnsureChannelMembershipAsync(userId, channelName, password);
         if (!success)
-            return ([], error);
+            return ([], error, passwordRequired);
 
         var isNewJoin = _presenceTracker.JoinChannel(username, channelName);
 
@@ -136,7 +136,7 @@ public class ChatService : IChatService
         }
 
         var history = await GetChannelHistoryAsync(channelName, HubConstants.DefaultHistoryCount);
-        return (history, null);
+        return (history, null, false);
     }
 
     public async Task LeaveChannelAsync(string connectionId, string username, string channelName)