From 99c159ae313dc6e791ae82cf937a0e29f110d97c Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Tue, 27 Jan 2026 09:41:25 -0800
Subject: skip captcha for tor

---
 src/routes/(app)/reset/[code]/+page.svelte |  4 ++++
 src/routes/(static)/login/+page.svelte     |  4 ++++
 src/routes/(static)/register/+page.svelte  |  4 ++++
 src/routes/(static)/support/+page.svelte   | 14 ++++++++++++++
 4 files changed, 26 insertions(+)

(limited to 'src')

diff --git a/src/routes/(app)/reset/[code]/+page.svelte b/src/routes/(app)/reset/[code]/+page.svelte
index 4cecb4fb..755b7d19 100644
--- a/src/routes/(app)/reset/[code]/+page.svelte
+++ b/src/routes/(app)/reset/[code]/+page.svelte
@@ -15,9 +15,11 @@
   let loading;
   let recaptchaToken = "";
   let recaptchaSiteKey = PUBLIC_RECAPTCHA_SITE_KEY;
+  let isTor = $derived(browser && location.hostname.endsWith(".onion"));
 
   const getRecaptchaToken = () =>
     new Promise((resolve, reject) => {
+      if (isTor) return resolve("");
       if (!browser || !grecaptcha) return reject(new Error("captcha unavailable"));
       grecaptcha.ready(() => {
         grecaptcha
@@ -58,11 +60,13 @@
   });
 </script>
 
+{#if !isTor}
 <svelte:head
   ><script
     src={"https://www.google.com/recaptcha/api.js?render=" + recaptchaSiteKey}
   ></script></svelte:head
 >
+{/if}
 
 <div class="pt-10">
   <div class="w-[243px] mx-auto mb-10">
diff --git a/src/routes/(static)/login/+page.svelte b/src/routes/(static)/login/+page.svelte
index adc4c804..bec702a1 100644
--- a/src/routes/(static)/login/+page.svelte
+++ b/src/routes/(static)/login/+page.svelte
@@ -39,6 +39,7 @@
 
   let { challenge } = $derived(data);
   let recaptchaSiteKey = PUBLIC_RECAPTCHA_SITE_KEY;
+  let isTor = $derived(browser && location.hostname.endsWith(".onion"));
   let token = $state("");
 
   let cancel = () => (need2fa = false);
@@ -57,6 +58,7 @@
 
   const getRecaptchaToken = () =>
     new Promise((resolve, reject) => {
+      if (isTor) return resolve("");
       if (!browser || !grecaptcha) return reject(new Error("captcha unavailable"));
       grecaptcha.ready(() => {
         grecaptcha
@@ -151,11 +153,13 @@
   });
 </script>
 
+{#if !isTor}
 <svelte:head
   ><script
     src={"https://www.google.com/recaptcha/api.js?render=" + recaptchaSiteKey}
   ></script></svelte:head
 >
+{/if}
 
 <div
   class="mx-auto md:shadow-xl rounded-3xl max-w-xl w-full md:w-[480px] md:p-8 mb-20 space-y-5"
diff --git a/src/routes/(static)/register/+page.svelte b/src/routes/(static)/register/+page.svelte
index f47bb3c1..cc3eb722 100644
--- a/src/routes/(static)/register/+page.svelte
+++ b/src/routes/(static)/register/+page.svelte
@@ -30,6 +30,7 @@
   let { form, data } = $props();
   let { challenge } = $derived(data);
   let recaptchaSiteKey = PUBLIC_RECAPTCHA_SITE_KEY;
+  let isTor = $derived(browser && location.hostname.endsWith(".onion"));
 
   onMount(() => {
     if (browser) {
@@ -97,6 +98,7 @@
   let loading = $state();
   const getRecaptchaToken = () =>
     new Promise((resolve, reject) => {
+      if (isTor) return resolve("");
       if (!browser || !grecaptcha) return reject(new Error("captcha unavailable"));
       grecaptcha.ready(() => {
         grecaptcha
@@ -253,11 +255,13 @@
   });
 </script>
 
+{#if !isTor}
 <svelte:head
   ><script
     src={"https://www.google.com/recaptcha/api.js?render=" + recaptchaSiteKey}
   ></script></svelte:head
 >
+{/if}
 
 {#if need2fa}
   <Pin bind:value={token} title="Enter 2FA Code" {cancel} notify={false} />
diff --git a/src/routes/(static)/support/+page.svelte b/src/routes/(static)/support/+page.svelte
index 09959174..620ed018 100644
--- a/src/routes/(static)/support/+page.svelte
+++ b/src/routes/(static)/support/+page.svelte
@@ -15,9 +15,21 @@
   let message = $state();
   let sent = $state();
   let recaptchaSiteKey = PUBLIC_RECAPTCHA_SITE_KEY;
+  let isTor = $derived(browser && location.hostname.endsWith(".onion"));
 
   let submit = (e) => {
     e.preventDefault();
+    if (isTor) {
+      post("/post/email", {
+        username: user?.username || `${username} (unverified)`,
+        email,
+        message,
+        token: "",
+      })
+        .then(() => (sent = true))
+        .catch(() => fail("problem submitting"));
+      return;
+    }
     grecaptcha.ready(() => {
       grecaptcha.execute(recaptchaSiteKey, { action: "submit" }).then((token) =>
         post("/post/email", {
@@ -50,11 +62,13 @@
   });
 </script>
 
+{#if !isTor}
 <svelte:head
   ><script
     src={"https://www.google.com/recaptcha/api.js?render=" + recaptchaSiteKey}
   ></script></svelte:head
 >
+{/if}
 
 <div class="container max-w-lg mx-auto space-y-8 p-4 pb-20">
   {#if sent}
-- 
cgit v1.2.3