From 3f112ada56ab7dfa2ff661b5644de2ee9c0b16f6 Mon Sep 17 00:00:00 2001
From: WardPearce <wardpearce@pm.me>
Date: Tue, 17 Feb 2026 20:28:42 +1300
Subject: [PATCH] Added option to disable captcha

---
 docs/DOCKER-FULL.md                           |  6 ++++
 materialious/src/lib/server/captcha.ts        |  3 ++
 materialious/src/lib/shared/index.ts          |  4 ++-
 .../routes/(app)/internal/login/+page.svelte  | 34 ++++++++++---------
 .../src/routes/api/user/create/+server.ts     |  4 +--
 .../src/routes/api/user/login/+server.ts      |  4 +--
 6 files changed, 34 insertions(+), 21 deletions(-)

diff --git a/docs/DOCKER-FULL.md b/docs/DOCKER-FULL.md
index 73f21cd8..64a57f2e 100644
--- a/docs/DOCKER-FULL.md
+++ b/docs/DOCKER-FULL.md
@@ -12,6 +12,9 @@ invidious_companion:
     public_url:  "http://companion.example.com/companion"
 ```
 
+### Proof-of-work Captcha
+Will only work while using HTTPS. If in HTTP set `PUBLIC_CAPTCHA_DISABLED` to `true`
+
 ### Docker Compose
 
 ```yaml
@@ -42,6 +45,9 @@ services:
       # Allow anyone to register
       PUBLIC_REGISTRATION_ALLOWED: "false"
       
+      # Disable POW Captcha
+      PUBLIC_CAPTCHA_DISABLED: "false"
+      
       # Allow any domain in proxy
       # This shouldn't be used unless you KNOW what your doing
       # requires VITE_REGISTRATION_ALLOWED to be false
diff --git a/materialious/src/lib/server/captcha.ts b/materialious/src/lib/server/captcha.ts
index a8636118..4b1b5cdc 100644
--- a/materialious/src/lib/server/captcha.ts
+++ b/materialious/src/lib/server/captcha.ts
@@ -1,8 +1,11 @@
 import { error } from '@sveltejs/kit';
 import { verifySolution } from 'altcha-lib';
 import { getSequelize } from './database';
+import { isOwnBackend } from '$lib/shared';
 
 export async function verifyCaptcha(payload: string, key: string, maxUses: number = -1) {
+	if (isOwnBackend()?.captchaDisabled) return;
+
 	const passedCaptcha = await verifySolution(payload, key, true);
 	if (!passedCaptcha) {
 		throw error(400, 'Unsupported payload');
diff --git a/materialious/src/lib/shared/index.ts b/materialious/src/lib/shared/index.ts
index e8d6a5f8..de9f35be 100644
--- a/materialious/src/lib/shared/index.ts
+++ b/materialious/src/lib/shared/index.ts
@@ -6,6 +6,7 @@ export type IsOwnBackend = {
 	requireAuth: boolean;
 	registrationAllowed: boolean;
 	allowAnyProxy: boolean;
+	captchaDisabled: boolean;
 };
 
 export function isOwnBackend(): IsOwnBackend | null {
@@ -16,6 +17,7 @@ export function isOwnBackend(): IsOwnBackend | null {
 		internalAuth: env.PUBLIC_INTERNAL_AUTH !== 'false',
 		requireAuth: env.PUBLIC_REQUIRE_AUTH !== 'false',
 		registrationAllowed: env.PUBLIC_REGISTRATION_ALLOWED === 'true',
-		allowAnyProxy: env.PUBLIC_DANGEROUS_ALLOW_ANY_PROXY === 'true'
+		allowAnyProxy: env.PUBLIC_DANGEROUS_ALLOW_ANY_PROXY === 'true',
+		captchaDisabled: env.PUBLIC_CAPTCHA_DISABLED === 'true'
 	};
 }
diff --git a/materialious/src/routes/(app)/internal/login/+page.svelte b/materialious/src/routes/(app)/internal/login/+page.svelte
index bf6c5af9..ef374b6d 100644
--- a/materialious/src/routes/(app)/internal/login/+page.svelte
+++ b/materialious/src/routes/(app)/internal/login/+page.svelte
@@ -81,22 +81,24 @@
 					{/if}
 				</div>
 
-				<article
-					class="surface-container-highest no-padding"
-					style="width: 100%;height: fit-content;"
-				>
-					<altcha-widget
-						challengeurl="/api/captcha"
-						hidelogo
-						hidefooter
-						onstatechange={(ev) => {
-							const { payload, state } = ev.detail;
-							if (state === 'verified' && payload) {
-								captchaPayload = payload;
-							}
-						}}
-					></altcha-widget>
-				</article>
+				{#if !isOwnBackend()?.captchaDisabled}
+					<article
+						class="surface-container-highest no-padding"
+						style="width: 100%;height: fit-content;"
+					>
+						<altcha-widget
+							challengeurl="/api/captcha"
+							hidelogo
+							hidefooter
+							onstatechange={(ev) => {
+								const { payload, state } = ev.detail;
+								if (state === 'verified' && payload) {
+									captchaPayload = payload;
+								}
+							}}
+						></altcha-widget>
+					</article>
+				{/if}
 
 				<nav class="right-align">
 					<button
diff --git a/materialious/src/routes/api/user/create/+server.ts b/materialious/src/routes/api/user/create/+server.ts
index c1cf418b..a4f6be77 100644
--- a/materialious/src/routes/api/user/create/+server.ts
+++ b/materialious/src/routes/api/user/create/+server.ts
@@ -16,7 +16,7 @@ const zUserCreate = z.object({
 		cipher: z.string().max(255),
 		nonce: z.string().max(255)
 	}),
-	captchaPayload: z.string()
+	captchaPayload: z.string().optional()
 });
 
 export async function POST({ request, cookies, locals }) {
@@ -28,7 +28,7 @@ export async function POST({ request, cookies, locals }) {
 
 	if (!userToCreate.success) throw error(400);
 
-	await verifyCaptcha(userToCreate.data.captchaPayload, locals.captchaKey, 1);
+	await verifyCaptcha(userToCreate.data.captchaPayload ?? '', locals.captchaKey, 1);
 
 	const createdUser = await createUser({
 		username: userToCreate.data.username,
diff --git a/materialious/src/routes/api/user/login/+server.ts b/materialious/src/routes/api/user/login/+server.ts
index 39f4817e..2db3a89b 100644
--- a/materialious/src/routes/api/user/login/+server.ts
+++ b/materialious/src/routes/api/user/login/+server.ts
@@ -8,7 +8,7 @@ import { verifyCaptcha } from '$lib/server/captcha';
 const zUserLogin = z.object({
 	username: z.string(),
 	passwordHash: z.string(),
-	captchaPayload: z.string()
+	captchaPayload: z.string().optional()
 });
 
 export async function POST({ request, cookies, locals }) {
@@ -20,7 +20,7 @@ export async function POST({ request, cookies, locals }) {
 
 	if (!userLogin.success) throw error(401);
 
-	await verifyCaptcha(userLogin.data.captchaPayload, locals.captchaKey, 1);
+	await verifyCaptcha(userLogin.data.captchaPayload ?? '', locals.captchaKey, 1);
 
 	const userModel = await authenticateUser(userLogin.data.username, userLogin.data.passwordHash);