1 files changed, 15 insertions, 9 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 130240e..fbba6d7 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -100,18 +100,24 @@ def _generate_code() -> str:
 async def _verify_captcha_or_raise(token: str | None, request: Request) -> None:
     if not token:
         raise HTTPException(status_code=400, detail="captcha_required")
-    from meshbay_hub.captcha import verify_captcha
-    ok = await verify_captcha(
-        _cfg.captcha.secret_key,  # type: ignore[union-attr]
-        token,
-        request.client.host if request.client else None,
-        _cfg.captcha.host_check,  # type: ignore[union-attr]
-        _cfg.captcha.allow_unattributed_host,  # type: ignore[union-attr]
-    )
-    if not ok:
+    from meshbay_hub.captcha import verify
+    if not verify(token):
         raise HTTPException(status_code=400, detail="captcha_failed")
 
 
+@router.get("/captcha")
+@limiter.limit("30/minute")
+async def captcha_challenge(request: Request):
+    """A proof-of-work challenge for the register and reset-request forms.
+
+    404 when this hub has the check turned off, so the page sends no answer.
+    """
+    if not (_cfg and _cfg.captcha.enabled):
+        raise HTTPException(status_code=404, detail="captcha_disabled")
+    from meshbay_hub.captcha import issue
+    return issue(_cfg.captcha.max_number)
+
+
 # ── Models ────────────────────────────────────────────────────────────────────
 
 # Mirrored by USERNAME_MIN_LEN in static/auth-page.js; test_username_floor.py