feat(api): protect group dm changes (#1244)

fluxer_api/src/api/channel/controllers/ChannelController.ts

@@ -21,6 +21,7 @@ import {z} from 'zod';
 import {requireSudoMode} from '../../auth/services/SudoVerificationService';
 import {createChannelID, createUserID} from '../../BrandedTypes';
 import {DefaultUserOnly, LoginRequired} from '../../middleware/AuthMiddleware';
+import {GroupDmRecipientAddProtectionMiddleware} from '../../middleware/GroupDmProtectionMiddleware';
 import {RateLimitMiddleware} from '../../middleware/RateLimitMiddleware';
 import {OpenAPI} from '../../middleware/ResponseTypeMiddleware';
 import {SudoModeMiddleware} from '../../middleware/SudoModeMiddleware';
@@ -208,11 +209,12 @@ export function ChannelController(app: HonoApp) {
 		RateLimitMiddleware(RateLimitConfigs.CHANNEL_UPDATE),
 		LoginRequired,
 		Validator('param', ChannelIdUserIdParam),
+		GroupDmRecipientAddProtectionMiddleware,
 		OpenAPI({
 			operationId: 'add_group_dm_recipient',
 			summary: 'Add recipient to group DM',
 			description:
-				'Adds a user to a group direct message channel. The requesting user must be a member of the group DM.',
+				'Adds a user to a group direct message channel. The requesting user must be a member of the group DM. Requires CAPTCHA verification.',
 			responseSchema: null,
 			statusCode: 204,
 			security: ['botToken', 'bearerToken', 'sessionToken'],