* doc/misc/erc.texi: Revise descriptions in SASL chapter to reflect
simplified auth-source options.

* lisp/erc/erc-sasl.el (erc-sasl-password,
erc-sasl-auth-source-function): Revise doc strings.
(erc-sasl-auth-source-password-as-host): New function to serve as
more useful choice for option `erc-sasl-auth-source-function'.
(erc-sasl--read-password): Promote auth-source to pole position, above
an explicit string and `:password'.

* test/lisp/erc/erc-sasl-tests.el (erc-sasl--read-password--basic):
Massage tests to conform to simplified `erc-sasl-password'
API.  (Bug#29108.)

* lisp/erc/erc-sasl.el (erc-sasl--read-password): Consult cached
options instead of `erc-sasl-auth-source-function'.
(erc-sasl--init): Add `erc-sasl-auth-source-function' to
`erc-sasl--options'.

* test/lisp/erc/erc-sasl-tests.el (erc-sasl--read-password--basic,
erc-sasl--read-password--auth-source): Look for original value of
`erc-sasl-auth-source-function' in `erc-sasl--options' under the
`authfn' key.

* test/lisp/erc/erc-scenarios-base-local-modules.el: New file.
* test/lisp/erc/resources/base/local-modules/first.eld: New file.
* test/lisp/erc/resources/base/local-modules/fourth.eld: New file
* test/lisp/erc/resources/base/local-modules/second.eld: New file.
* test/lisp/erc/resources/base/local-modules/third.eld: New file.
(Bug#57955.)

* lisp/erc/erc-backend.el (erc-session-password): Add comment
explaining type is now string, nil, or function.
* lisp/erc/erc-compat.el (erc-compat--29-auth-source-pass-search):
Use obfuscation from auth-source function when available.
* lisp/erc/erc-sasl.el (erc-sasl--read-password,
erc-server-AUTHENTICATE): Use `erc--unfun'.
* lisp/erc/erc-services.el (erc-nickserv-get-password,
erc-nickserv-send-identify): Use `erc--unfun'.
* lisp/erc/erc.el (erc--unfun): New function for unwrapping a
password couched in a getter.
(erc--debug-irc-protocol-mask-secrets): Add variable to indicate
whether to mask passwords in debug logs.
(erc--mask-secrets): New function to swap masked secret with question
marks in debug logs.
(erc-log-irc-protocol): Conditionally mask secrets when
`erc--debug-irc-protocol-mask-secrets' is non-nil.
(erc--auth-source-search): Don't unwrap secret from function before
returning.
(erc-server-join-channel, erc-login): Use `erc--unfun'.

* test/lisp/erc/erc-services-tests.el
(erc-services-tests--wrap-search): Add helper for `erc--unfun'.
(erc-services-tests--auth-source-standard,
erc-services-tests--auth-source-announced,
erc-services-tests--auth-source-overrides, erc-nickserv-get-password):
Use `erc--unfun'.
* test/lisp/erc/erc-tests.el (erc--debug-irc-protocol-mask-secrets):
Add test for masking secrets with `erc--unfun' and friends.

* doc/misc/erc.texi: Add SASL section in Advanced Usage chapter to
document the new SASL module.

* etc/ERC-NEWS: Mention addition of erc-sasl module for SASL support.

* lisp/erc/erc-compat.el
(erc-compat--29-sasl-scram-construct-gs2-header,
erc-compat--29-sasl-scram-client-first-message,
erc-compat--29-sasl-scram--client-final-message): Fix encoding bug and
add minimal authorization support with copies of SASL functions
introduced in Emacs 29.

* lisp/erc/erc.el (erc-modules): Add `sasl'.
* lisp/erc/erc-sasl.el: New file (bug#29108).
* test/lisp/erc/erc-sasl-tests.el: New file.
* test/lisp/erc/erc-scenarios-sasl.el: New file.
* test/lisp/erc/resources/sasl/plain-failed.eld: New file.
* test/lisp/erc/resources/sasl/plain.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-1.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-256.eld: New file.
* test/lisp/erc/resources/sasl/external.eld: New file.

* doc/misc/erc.texi: Mention local modules in Modules chapter.

* etc/ERC-NEWS: Mention changes to `erc-update-modules'.

* lisp/erc/erc.el (erc-migrate-modules): Add some missing mappings.
(erc-modules): When a user removes a module, disable it and kill its
local variable in all ERC buffers.
(erc-update-modules): Move body of `erc-update-modules' to new
internal function.
(erc--update-modules): Add new function, a renamed and slightly
modified version of `erc-update-modules'.  Specifically, change return
value from nil to a list of minor-mode commands for local modules.
Use `custom-variable-p' to detect flavor.
(erc--merge-local-modes): Add helper for finding local modules
already active as minor modes in an ERC buffer.
(erc-open): Replace `erc-update-modules' with `erc--update-modules'.
Defer enabling of local modules via `erc--update-modules' until after
buffer is initialized with other local vars.  Also defer major-mode
hooks so they can detect things like whether the buffer is a server or
target buffer.  Also ensure local module setup code can detect when
`erc-open' was called with a non-nil `erc--server-reconnecting'.

* lisp/erc/erc-common.el (erc--module-name-migrations,
erc--features-to-modules, erc--modules-to-features): Add alists of
old-to-new module names to support module-name migrations.
(erc--assemble-toggle): Add new helper for constructing mode toggles,
like `erc-sasl-enable'.
(define-erc-modules): Defer to `erc--assemble-toggle' to create toggle
commands.
(erc--normalize-module-symbol): Add helper for `erc-migrate-modules'.

* lisp/erc/erc-goodies.el: Require cl-lib.

* test/lisp/erc/erc-tests.el (erc-migrate-modules,
erc--update-modules): Add rudimentary unit tests asserting correct
module-name mappings.
(erc--merge-local-modes): Add test for helper.
(define-erc-module--global, define-erc-module--local): Add tests
asserting module-creation macro.  (Bug#57955.)

* lisp/erc/erc-networks.el (erc-networks--id-given): Accept a null
argument.
(erc-networks--id-on-connect): Remove unused function.
(erc-networks--id-equal-p): Add method for comparing initialized and
unset IDs.
(erc-networks--update-server-identity): Ensure `erc-networks--id' is
set before continuing search.
(erc-networks--init-identity): Don't assume `erc-networks--id' is
non-nil.  Add branch condition to reload ID on non-nil case.
(erc-networks-on-MOTD-end): Let init-ID function handle renaming of
server buffer.

* lisp/erc/erc.el (erc-open): For continued sessions, try copying over
the last network ID.
(erc--auth-source-determine-params-default): Don't expect a network ID
to have been initialized.
(erc-set-current-nick): When connected, reload network ID.  Leave
comment warning that it may be unneeded.

* lisp/erc/erc-backend.el (erc-server-NICK, erc-server-433): Unless
already connected, schedule ID reload when server rejects or mandates
a nick change.

* test/lisp/erc/erc-scenarios-base-association-nick.el
(erc-scenarios-base-association-nick-bumped,
erc-scenarios-base-association-nick-bumped-mandated-renick): Update to
reflect more liberal association behavior when renamed by IRCd.