Add CAPTCHA challenge (Cloudflare Turnstile) on signup and sensitive operations

[PeaStew]

Summary

The codebase has zero CAPTCHA or challenge-response mechanisms. Account registration, login, device creation, and share operations are all completely unprotected from automated scripts. A simple curl loop can create unlimited accounts.

Recommendation: Cloudflare Turnstile

Turnstile is recommended over reCAPTCHA because:

• Free tier is generous
• Privacy-respecting (no tracking cookies)
• Invisible mode available (no user friction for legitimate users)
• Does not require Cloudflare proxy (works standalone)

Endpoints to protect

Endpoint	Priority	Mode
POST /api/auth/sign-up	Critical	Managed (visible if suspicious)
POST /api/auth/sign-in	Critical	Invisible
POST /v2/devices/create	High	Invisible
POST /v1/devices/register	High	Invisible
POST /v2/accounts/import-share	High	Invisible

Implementation

Client-side (iframe/frontend):

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

Embed widget, get cf-turnstile-response token, attach to API requests.

Server-side (auth_service + hot_storage):
Validate the token via Turnstile siteverify API before processing the request. Add as middleware that runs before auth on protected endpoints.

Alternative: Proof-of-Work

For endpoints where Turnstile adds too much latency or isn't appropriate (e.g., programmatic API access), consider a hashcash-style proof-of-work challenge:

• Server issues a challenge with target difficulty
• Client must compute a nonce that produces a hash below the target
• Trivial for a single request, expensive at scale for bots