From b4a2a12c2a6a58b46cb46fc6210650fa1de8a0aa Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Thu, 22 Jan 2026 10:02:37 -0800
Subject: api key captcha bypass

---
 routes/users.ts | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

(limited to 'routes')

diff --git a/routes/users.ts b/routes/users.ts
index f704da03..59aa0778 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -26,12 +26,20 @@ import type { ProfilePointer } from "nostr-tools/nip19";
 const { host } = new URL(process.env.URL);
 const relay = encodeURIComponent(config.publicRelay);
 
-const verifyRecaptcha = async (response, ip) => {
+const verifyRecaptcha = async (response, req?) => {
   const { recaptcha: secret } = config;
   if (!secret) return true;
+
+  // Check for valid API key to bypass captcha
+  const apiKey = req?.headers?.["x-api-key"];
+  if (apiKey && (await db.sIsMember("apikeys", apiKey))) {
+    return true;
+  }
+
   if (!response) return false;
 
   try {
+    const ip = req?.headers?.["cf-connecting-ip"] || req?.socket?.remoteAddress;
     const { success } = await got
       .post("https://www.google.com/recaptcha/api/siteverify", {
         form: {
@@ -356,7 +364,7 @@ export default {
       if (ipCount === 1) await db.expire(ipKey, 10);
       if (ipCount > 30) return res.code(429).send({});
 
-      const recaptchaOk = await verifyRecaptcha(recaptcha, ip);
+      const recaptchaOk = await verifyRecaptcha(recaptcha, req);
       if (!recaptchaOk) {
         return res.code(401).send("failed captcha");
       }
@@ -420,7 +428,7 @@ export default {
     try {
       const { event, challenge, twofa, recaptcha } = req.body;
       const ip = req.headers["cf-connecting-ip"];
-      const recaptchaOk = await verifyRecaptcha(recaptcha, ip);
+      const recaptchaOk = await verifyRecaptcha(recaptcha, req);
       if (!recaptchaOk) {
         return res.code(401).send("failed captcha");
       }
-- 
cgit v1.2.3