Method verifyCaptcha

internal/api/middleware.go:237–276

(w http.ResponseWriter, req *http.Request)

}

func (a *API) verifyCaptcha(w http.ResponseWriter, req *http.Request) (context.Context, error) {
	ctx := req.Context()
	config := a.config

	if !config.Security.Captcha.Enabled {
		return ctx, nil
	}
	if _, err := a.requireAdminCredentials(w, req); err == nil {
		// skip captcha validation if authorization header contains an admin role
		return ctx, nil
	}
	if shouldIgnore := isIgnoreCaptchaRoute(req); shouldIgnore {
		return ctx, nil
	}

	body := &captchaRequest{}
	if err := retrieveRequestParams(req, body); err != nil {
		return nil, err
	}

	token := strings.TrimSpace(body.Security.Token)
	if token == "" {
		return nil, apierrors.NewBadRequestError(apierrors.ErrorCodeCaptchaFailed, "captcha protection: request disallowed (no captcha_token found)")
	}

	verificationResult, err := a.captchaVerifier.Verify(
		ctx,
		token,
		utilities.GetIPAddress(req),
	)
	if err != nil {
		return nil, apierrors.NewInternalServerError("captcha verification process failed").WithInternalError(err)
	}

	if !verificationResult.Success {
		return nil, apierrors.NewBadRequestError(apierrors.ErrorCodeCaptchaFailed, "captcha protection: request disallowed (%s)", strings.Join(verificationResult.ErrorCodes, ", "))
	}

	return ctx, nil
}

func isIgnoreCaptchaRoute(req *http.Request) bool {
	if req.URL.Path != "/token" {