From 51705056a578d2649a989bf14a056fbcfae58a6b Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 14 Oct 2026 13:34:47 +0200 Subject: feat(hub): replace reCAPTCHA with a self-hosted proof of work Sign-up and passphrase reset sent every visitor's address and browser details to Google, which needed a consent the sign-up form could not ask for freely. The hub now issues its own challenge (ALTCHA's scheme, signed with a key derived from the hub's private key, single-use, 30 minutes) and the page solves it with SubtleCrypto while the form is filled in. - GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off. - [captcha] enabled / max_number replace site_key / secret_key, which are now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old variables. - No Google origin left in the CSP of the hub, the desktop shell or the Android shell; captcha_site_key leaves /v1/hub/info. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/tests/test_android_shell.py | 3 --- 1 file changed, 3 deletions(-) (limited to 'packages/meshbay-hub/tests/test_android_shell.py') diff --git a/packages/meshbay-hub/tests/test_android_shell.py b/packages/meshbay-hub/tests/test_android_shell.py index cd5a36e..1049a5f 100644 --- a/packages/meshbay-hub/tests/test_android_shell.py +++ b/packages/meshbay-hub/tests/test_android_shell.py @@ -71,7 +71,6 @@ def test_the_policy_is_the_desktop_policy_sent_as_a_header(): body = text.split(start, 1)[1].split(end, 1)[0] out = {} for d in re.findall(r"[`\"]([a-z-]+(?: [^`\"]*)?)[`\"]", body): - d = d.replace("${RECAPTCHA_SRC}", "$RECAPTCHA_SRC") out[d.split()[0]] = d return out @@ -82,8 +81,6 @@ def test_the_policy_is_the_desktop_policy_sent_as_a_header(): assets = _read(SRC / "shell" / "UiAssets.kt") assert '"Content-Security-Policy" to CSP' in assets - recaptcha = 'RECAPTCHA_SRC = "https://www.google.com https://www.gstatic.com"' - assert recaptcha in assets markup = re.sub(r"", "", _read(CLIENT / "scripts" / "index.html"), flags=re.S) assert "Content-Security-Policy" not in markup -- cgit v1.2.3