feat: refresh content workflow and verification settings

backend/src/controllers/subscription.rs

@@ -14,6 +14,10 @@ pub struct PublicSubscriptionPayload {
     pub source: Option<String>,
     #[serde(default, alias = "turnstileToken")]
     pub turnstile_token: Option<String>,
+    #[serde(default, alias = "captchaToken")]
+    pub captcha_token: Option<String>,
+    #[serde(default, alias = "captchaAnswer")]
+    pub captcha_answer: Option<String>,
 }
 
 #[derive(Clone, Debug, Deserialize)]
@@ -23,6 +27,10 @@ pub struct PublicBrowserPushSubscriptionPayload {
     pub source: Option<String>,
     #[serde(default, alias = "turnstileToken")]
     pub turnstile_token: Option<String>,
+    #[serde(default, alias = "captchaToken")]
+    pub captcha_token: Option<String>,
+    #[serde(default, alias = "captchaAnswer")]
+    pub captcha_answer: Option<String>,
 }
 
 #[derive(Clone, Debug, Deserialize)]
@@ -81,6 +89,28 @@ fn public_browser_push_metadata(
     })
 }
 
+async fn verify_subscription_human_check(
+    settings: &crate::models::_entities::site_settings::Model,
+    turnstile_token: Option<&str>,
+    captcha_token: Option<&str>,
+    captcha_answer: Option<&str>,
+    client_ip: Option<&str>,
+) -> Result<()> {
+    match turnstile::effective_mode(settings, turnstile::TurnstileScope::Subscription) {
+        turnstile::VerificationMode::Off => Ok(()),
+        turnstile::VerificationMode::Captcha => {
+            crate::services::comment_guard::verify_captcha_solution(
+                captcha_token,
+                captcha_answer,
+                client_ip,
+            )
+        }
+        turnstile::VerificationMode::Turnstile => {
+            turnstile::verify_token(settings, turnstile_token, client_ip).await
+        }
+    }
+}
+
 #[debug_handler]
 pub async fn subscribe(
     State(ctx): State<AppContext>,
@@ -94,10 +124,12 @@ pub async fn subscribe(
         client_ip.as_deref(),
         Some(&email),
     )?;
-    let _ = turnstile::verify_if_enabled(
-        &ctx,
-        turnstile::TurnstileScope::Subscription,
+    let settings = crate::controllers::site_settings::load_current(&ctx).await?;
+    verify_subscription_human_check(
+        &settings,
         payload.turnstile_token.as_deref(),
+        payload.captcha_token.as_deref(),
+        payload.captcha_answer.as_deref(),
         client_ip.as_deref(),
     )
     .await?;
@@ -165,10 +197,11 @@ pub async fn subscribe_browser_push(
         .map(ToString::to_string);
 
     abuse_guard::enforce_public_scope("browser-push-subscription", client_ip.as_deref(), Some(&endpoint))?;
-    let _ = turnstile::verify_if_enabled(
-        &ctx,
-        turnstile::TurnstileScope::Subscription,
+    verify_subscription_human_check(
+        &settings,
         payload.turnstile_token.as_deref(),
+        payload.captcha_token.as_deref(),
+        payload.captcha_answer.as_deref(),
         client_ip.as_deref(),
     )
     .await?;