hcaptcha

.editorconfig

···
 
 [*.v]
 indent_style = tab
+
+[*.{html,css,js}]
+indent_style = tab

compose.yml

···
+version: "3"
+volumes:
+  beep-data:
+  beep-data-export:
+services:
+  beep-database:
+    image: docker.io/postgres:15-alpine
+    container_name: beep-database
+    ports:
+      - 5432:5432
+    environment:
+      - POSTGRES_DB=beep
+      - POSTGRES_USER=beep
+      - POSTGRES_PASSWORD=beep
+    volumes:
+      - beep-data:/var/lib/postgresql/data
+      - beep-data-export:/export

config.maple

···
 	db = 'beep'
 }
 
+hcaptcha = {
+	enabled = false
+	secret = ''
+	site_key = ''
+}
+
 post = {
 	title_min_len = 1
 	title_max_len = 50

doc/resources.md

···
 	- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html#other-examples-of-safe-prepared-statements
 	- https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html#using-net-built-in-feature
 	- https://www.slideshare.net/slideshow/sql-injection-myths-and-fallacies/3729931#3
+
+## misc
+
+- https://stackoverflow.blog/2021/12/28/what-i-wish-i-had-known-about-single-page-applications/
+	- i thought about turning beep into a single page application (spa),
+	then done a bit of research. this blog post pointed out a variety of
+	problems that the author had with their spa, and many of those problems
+	would be problems for beep too.
+	- tl;dr: this blog post gave me the warnings about an spa before i
+	wasted my time implementing it on beep.

src/main.v

···
 		log: true
 	)
 
-	defer { app.db.close() }
+	defer { app.db.close() or { panic(err) } }
 
 	// add authenticator
 	app.auth = auth.new(app.db)

src/templates/register.html

···
 			required
 		>
 		<br>
+		@if app.config.hcaptcha.enabled
+		<div class="h-captcha" data-sitekey="@{app.config.hcaptcha.site_key}"></div>
+		<script src="https://js.hcaptcha.com/1/api.js" async defer></script>
+		<br>
+		@end
 		<input type="submit" value="register">
 	</form>
 	@end
 </div>
 
-@include 'partial/footer.html'
+@include 'partial/footer.html'

src/webapp/api.v

···
 
 import veb
 import auth
-import entity { Like, LikeCache, Post, Site, User, Notification }
+import entity { Like, Post, User }
 import database { PostSearchResult }
+import net.http
+import json
 
 // search_hard_limit is the maximum limit for a search query, used to prevent
 // people from requesting searches with huge limits and straining the SQL server
-pub const search_hard_limit := 50
+pub const search_hard_limit = 50
 
 ////// user //////
 
+struct HcaptchaResponse {
+pub:
+	success     bool
+	error_codes []string @[json: 'error-codes']
+}
+
 @['/api/user/register'; post]
 fn (mut app App) api_user_register(mut ctx Context, username string, password string) veb.Result {
+	// before doing *anything*, check the captchas
+	if app.config.hcaptcha.enabled {
+		token := ctx.form['h-captcha-response']
+		response := http.post('https://api.hcaptcha.com/siteverify', '{
+			"secret": "${app.config.hcaptcha.site_key}",
+			"remoteip": "${ctx.ip()}",
+			"response": "${token}"
+		}') or {
+			ctx.error('failed to post hcaptcha response: ${err}')
+			return ctx.redirect('/register')
+		}
+		data := json.decode(HcaptchaResponse, response.body) or {
+			ctx.error('failed to decode hcaptcha response: ${err}')
+			return ctx.redirect('/register')
+		}
+		if !data.success {
+			ctx.error('failed to verify hcaptcha: ${data}')
+			return ctx.redirect('/register')
+		}
+	}
+
 	if app.get_user_by_name(username) != none {
 		ctx.error('username taken')
 		return ctx.redirect('/register')
···
 	}
 
 	if x := app.new_user(user) {
-		app.send_notification_to(
-			x.id,
-			app.config.welcome.summary.replace('%s', x.get_name()),
-			app.config.welcome.body.replace('%s', x.get_name())
-		)
+		app.send_notification_to(x.id, app.config.welcome.summary.replace('%s', x.get_name()),
+			app.config.welcome.body.replace('%s', x.get_name()))
 		token := app.auth.add_token(x.id, ctx.ip()) or {
 			eprintln(err)
 			ctx.error('api_user_register: could not create token for user with id ${x.id}')
···
 
 @['/api/user/whoami'; get]
 fn (mut app App) api_user_whoami(mut ctx Context) veb.Result {
-	user := app.whoami(mut ctx) or {
-		return ctx.text('not logged in')
-	}
+	user := app.whoami(mut ctx) or { return ctx.text('not logged in') }
 	return ctx.text(user.username)
 }
 
···
 
 @['/api/post/get/<id>'; get]
 fn (mut app App) api_post_get_post(mut ctx Context, id int) veb.Result {
-	post := app.get_post_by_id(id) or {
-		return ctx.text('no such post')
-	}
+	post := app.get_post_by_id(id) or { return ctx.text('no such post') }
 	return ctx.json[Post](post)
 }
 

src/webapp/config.v

···
 		password string
 		db       string
 	}
+	hcaptcha    struct {
+	pub mut:
+		enabled  bool
+		secret   string
+		site_key string
+	}
 	post        struct {
 	pub mut:
 		title_min_len int
···
 	config.postgres.user = loaded_postgres.get('user').to_str()
 	config.postgres.password = loaded_postgres.get('password').to_str()
 	config.postgres.db = loaded_postgres.get('db').to_str()
+
+	loaded_hcaptcha := loaded.get('hcaptcha')
+	config.hcaptcha.enabled = loaded_hcaptcha.get('enabled').to_bool()
+	config.hcaptcha.secret = loaded_hcaptcha.get('secret').to_str()
+	config.hcaptcha.site_key = loaded_hcaptcha.get('site_key').to_str()
 
 	loaded_post := loaded.get('post')
 	config.post.title_min_len = loaded_post.get('title_min_len').to_int()

v.mod

···
 Module {
 	name: 'beep'
-	description: 'A self-hosted mini-blogger'
+	description: 'a self-hosted mini-blogger'
 	version: '1.0.0'
 	license: 'MIT'
 	author: 'EmmaTheMartian'