From 51705056a578d2649a989bf14a056fbcfae58a6b Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 14 Oct 2026 13:34:47 +0200 Subject: feat(hub): replace reCAPTCHA with a self-hosted proof of work Sign-up and passphrase reset sent every visitor's address and browser details to Google, which needed a consent the sign-up form could not ask for freely. The hub now issues its own challenge (ALTCHA's scheme, signed with a key derived from the hub's private key, single-use, 30 minutes) and the page solves it with SubtleCrypto while the form is filled in. - GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off. - [captcha] enabled / max_number replace site_key / secret_key, which are now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old variables. - No Google origin left in the CSP of the hub, the desktop shell or the Android shell; captcha_site_key leaves /v1/hub/info. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/app.py | 2 -- 1 file changed, 2 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/app.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/app.py b/packages/meshbay-hub/src/meshbay_hub/app.py index 2ad71bd..6155470 100644 --- a/packages/meshbay-hub/src/meshbay_hub/app.py +++ b/packages/meshbay-hub/src/meshbay_hub/app.py @@ -23,7 +23,6 @@ from meshbay_hub.api.federation import router as federation_router from meshbay_hub.api.groups import router as groups_router from meshbay_hub.api.health import router as health_router from meshbay_hub.api.hub import router as hub_router -from meshbay_hub.api.hub import set_config as hub_set_config from meshbay_hub.api.invite_links import redeem_router as invite_links_redeem_router from meshbay_hub.api.invite_links import router as invite_links_router from meshbay_hub.api.middleware import limiter @@ -140,7 +139,6 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI: generate_hub_keypair(kp) load_hub_keypair(kp, cfg.identity.id) users_set_config(cfg) - hub_set_config(cfg) set_admin_usernames(cfg.identity.admin_usernames) await _backfill_email_hashes() -- cgit v1.2.3