Fix users getting extra privileges when migrating to flags.

data/chanserv.example.conf

@@ -252,6 +252,7 @@ privilege
 	rank = 10
 	level = 3
 	flag = "f"
+	flag_migration_requires = "ACCESS_CHANGE"
 	xop = "VOP"
 }
 
@@ -496,6 +497,7 @@ privilege
 	rank = 110
 	level = 4
 	flag = "h"
+	flag_migration_requires = "HALFOP"
 	xop = "HOP"
 }
 
@@ -638,6 +640,7 @@ privilege
 	rank = 220
 	level = 5
 	flag = "o"
+	flag_migration_requires = "OP"
 	xop = "AOP"
 }
 
@@ -710,6 +713,7 @@ privilege
 	rank = 300
 	level = 10
 	flag = "a"
+	flag_migration_requires = "PROTECT"
 	xop = "SOP"
 }
 
@@ -853,6 +857,7 @@ privilege
 	rank = 60
 	level = 3
 	flag = "v"
+	flag_migration_requires = "VOICE"
 	xop = "VOP"
 }
 

include/language.h

@@ -144,8 +144,8 @@ namespace Language
 #define CHAN_ACCESS_FOREIGN         N_("%u access entry from other access systems not shown; use \002%s\033ALL\002 to view all access entries.", "%u access entries from other access systems not shown; use \002%s\033ALL\002 to view all access entries.")
 #define CHAN_ACCESS_MIGRATED_1       _("\002%s\002 has been migrated to the %s access system.")
 #define CHAN_ACCESS_MIGRATED_N      N_("\002%u\002 entry has been migrated to the %s access system.", "\002%u\002 entries have been migrated to the %s access system.")
-#define CHAN_ACCESS_NOT_MIGRATED_1   _("\002%s\002 can not be migrated to the %s access system because they have privileges that you do not.")
+#define CHAN_ACCESS_NOT_MIGRATED_1   _("\002%s\002 can not be migrated to the %s access system because they have privileges that you do not or they have no migratable privileges.")
-#define CHAN_ACCESS_NOT_MIGRATED_N  N_("\002%u\002 entry can not be migrated to the %s access system because they have privileges that you do not.", "\002%u\002 entries can not be migrated to the %s access system because they have privileges that you do not.")
+#define CHAN_ACCESS_NOT_MIGRATED_N  N_("\002%u\002 entry can not be migrated to the %s access system because they have privileges that you do not.", "\002%u\002 entries can not be migrated to the %s access system because they have privileges that you do not or they have no migratable privileges.")
 #define CHAN_EXCEPTED                _("\002%s\002 matches an except on %s and cannot be banned until the except has been removed.")
 #define CHAN_INFO_HEADER             _("Information about channel \002%s\002:")
 #define CHAN_LIMIT_EXCEEDED          _("You have already exceeded your limit of \002%d\002 channels.")

language/anope.en_US.po

@@ -16,8 +16,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Anope\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-14 09:44+0100\n"
+"POT-Creation-Date: 2026-05-15 08:42+0100\n"
-"PO-Revision-Date: 2026-05-14 09:44+0100\n"
+"PO-Revision-Date: 2026-05-15 08:42+0100\n"
 "Last-Translator: Sadie Powell <sadie@sadiepowell.dev>\n"
 "Language-Team: English\n"
 "Language: en_US\n"
@@ -131,7 +131,7 @@ msgstr ""
 
 #: ../include/language.h
 #, c-format
-msgid "%s can not be migrated to the %s access system because they have privileges that you do not."
+msgid "%s can not be migrated to the %s access system because they have privileges that you do not or they have no migratable privileges."
 msgstr ""
 
 #: ../modules/botserv/bs_kick.cpp
@@ -431,7 +431,7 @@ msgstr ""
 #: ../include/language.h
 #, c-format
 msgid "%u entry can not be migrated to the %s access system because they have privileges that you do not."
-msgid_plural "%u entries can not be migrated to the %s access system because they have privileges that you do not."
+msgid_plural "%u entries can not be migrated to the %s access system because they have privileges that you do not or they have no migratable privileges."
 msgstr[0] ""
 msgstr[1] ""
 

modules/chanserv/cs_flags.cpp

@@ -15,6 +15,7 @@
 #include "module.h"
 
 static std::map<Anope::string, char> defaultFlags;
+static Anope::map<Anope::string> migrationRequires;
 
 class FlagsChanAccess final
 	: public ChanAccess
@@ -438,15 +439,31 @@ class CommandCSFlags final
 					{
 						notmigrated++;
 						notmigratedmask = access->Mask();
+						Log(LOG_DEBUG) << source.GetNick() << " does not have the access to migrate " << access->Mask() << " to flags";
 						continue; // No privs
 					}
 
 					override = true;
 				}
 
+				auto req = migrationRequires.find(priv);
+				if (req != migrationRequires.end() && !access->HasPriv(req->second))
+				{
+					Log(LOG_DEBUG) << access->Mask() << " has " << priv << " but not " << req->second << " so it will be lost on migration to flags";
+					continue; // Required flag missing.
+				}
+
 				newflags.insert(flag);
 			}
 
+			if (newflags.empty())
+			{
+				notmigrated++;
+				notmigratedmask = access->Mask();
+				Log(LOG_DEBUG) << access->Mask() << " has " << access->AccessSerialize() << " that can not be migrated to flags";
+				continue; // No privs that are migratable
+			}
+
 			migrated++;
 			migratedmask = access->Mask();
 
@@ -638,6 +655,10 @@ public:
 			if (value.empty())
 				continue;
 
+			const auto &migration_requires = priv.Get<const Anope::string>("flag_migration_requires");
+			if (!migration_requires.empty())
+				migrationRequires[p->name] = migration_requires;
+
 			defaultFlags[p->name] = value[0];
 		}
 	}