From 79dec0747646ebe530fa139e73d7653feb2fe331 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Mon, 26 Jan 2026 08:40:49 -0800
Subject: captcha bypass whitelist

---
 routes/users.ts | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

(limited to 'routes')

diff --git a/routes/users.ts b/routes/users.ts
index 8cb24870..c5fd0c39 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -36,6 +36,9 @@ const verifyRecaptcha = async (response, req?) => {
     return true;
   }
 
+  const { username } = req.body;
+  if (await db.sIsMember("nocaptcha", username)) return true;
+
   if (!response) return false;
 
   try {
@@ -641,22 +644,22 @@ export default {
       user: u,
     } = req;
     try {
-    const admin = u?.admin;
-    let id;
-    let user;
+      const admin = u?.admin;
+      let id;
+      let user;
 
       if (u.username !== config.admin) fail("disabled");
       id = await g(`user:${username.toLowerCase().replace(/\s/g, "")}`);
       user = await g(`user:${id}`);
 
-    if (!user) fail("user not found");
+      if (!user) fail("user not found");
 
-    warn(
-      "password reset",
-      user.username,
-      code,
-      req.headers["cf-connecting-ip"],
-    );
+      warn(
+        "password reset",
+        user.username,
+        code,
+        req.headers["cf-connecting-ip"],
+      );
 
       user.pin = null;
       user.nsec = null;
-- 
cgit v1.2.3