Sign-up code guard: honeypot, form age, per-IP + global limits, progressive icon check, burst alert

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-11 06:30:03 -05:00
parent f9b198a49b
commit 159e19dcdf
7 changed files with 107 additions and 11 deletions
@@ -143,5 +143,29 @@ window.IAP = (function () {
      el.hidden = false;
    } catch (e) {}
  }
-  return { getConfig, fmtPol, fmtUsd, status, renderNav, refreshNavWallet, describeEvent, feedRow, adSlot, reportAd, $ };
+  // ── sign-up code request with the invisible guard fields (form age + honeypot)
+  // and the icon check the server asks for only after an IP trips a limit ──
+  const FORM_TS = Date.now();
+  function iconCheck(host, ch, note) {
+    return new Promise(resolve => {
+      host.hidden = false;
+      host.innerHTML = '<div class="small" style="margin:0 0 8px">' + (note ? esc(note) + ' ' : '') + 'Tap the <b>' + esc(ch.prompt) + '</b>.</div>'
+        + '<div class="icon-check">' + ch.options.map(o => '<button type="button" class="ic-btn">' + esc(o) + '</button>').join('') + '</div>';
+      host.querySelectorAll('.ic-btn').forEach(b => b.addEventListener('click', () => { host.innerHTML = ''; host.hidden = true; resolve(b.textContent); }, { once: true }));
+    });
+  }
+  async function requestCode(email, opts) {
+    const o = opts || {};
+    let pick = null;
+    for (let i = 0; i < 4; i++) {
+      const r = await (await fetch('/api/auth/email/start', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, fts: FORM_TS, website: (o.honeypot && o.honeypot.value) || '', pick }) })).json();
+      if (r.challenge && o.host) { pick = await iconCheck(o.host, r.challenge, r.error); continue; }
+      if (r.error) throw new Error(r.error);
+      return r;
+    }
+    throw new Error('Could not verify. Refresh the page and try again.');
+  }
+  const esc = s => String(s == null ? '' : s).replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  return { getConfig, fmtPol, fmtUsd, status, renderNav, refreshNavWallet, describeEvent, feedRow, adSlot, reportAd, requestCode, $ };
 })();