From d5cc48a92d8e61729a747c585217a9fd0d4adcd4 Mon Sep 17 00:00:00 2001
From: Jiralite <33201955+Jiralite@users.noreply.github.com>
Date: Tue, 30 Jun 2026 22:35:36 +0100
Subject: [PATCH] fix: remove Flutter captcha bypass (#1234)

---
 fluxer_api/src/api/auth/AuthController.ts          | 4 ++--
 fluxer_api/src/api/middleware/CaptchaMiddleware.ts | 7 -------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/fluxer_api/src/api/auth/AuthController.ts b/fluxer_api/src/api/auth/AuthController.ts
index 36b7f9405..b3117b36a 100644
--- a/fluxer_api/src/api/auth/AuthController.ts
+++ b/fluxer_api/src/api/auth/AuthController.ts
@@ -39,7 +39,7 @@ import {
 } from '@fluxer/schema/src/domains/auth/AuthSchemas';
 import {Config} from '../Config';
 import {DefaultUserOnly, LoginRequiredAllowSuspicious} from '../middleware/AuthMiddleware';
-import {CaptchaMiddleware, CaptchaMiddlewareSkipFlutter} from '../middleware/CaptchaMiddleware';
+import {CaptchaMiddleware} from '../middleware/CaptchaMiddleware';
 import {LocalAuthMiddleware} from '../middleware/LocalAuthMiddleware';
 import {RateLimitMiddleware} from '../middleware/RateLimitMiddleware';
 import {OpenAPI} from '../middleware/ResponseTypeMiddleware';
@@ -133,7 +133,7 @@ export function AuthController(app: HonoApp) {
 	app.post(
 		'/auth/login',
 		LocalAuthMiddleware,
-		CaptchaMiddlewareSkipFlutter,
+		CaptchaMiddleware,
 		RateLimitMiddleware(RateLimitConfigs.AUTH_LOGIN),
 		Validator('json', LoginRequest),
 		OpenAPI({
diff --git a/fluxer_api/src/api/middleware/CaptchaMiddleware.ts b/fluxer_api/src/api/middleware/CaptchaMiddleware.ts
index 52c92543c..7c4c1c2b8 100644
--- a/fluxer_api/src/api/middleware/CaptchaMiddleware.ts
+++ b/fluxer_api/src/api/middleware/CaptchaMiddleware.ts
@@ -11,7 +11,6 @@ import type {InstanceCaptchaEffectiveConfig, InstanceCaptchaProvider} from '../i
 import type {User} from '../models/User';
 import {accountPolicyContactHasCapability} from '../risk/AccountPolicyService';
 import type {HonoEnv} from '../types/HonoEnv';
-import {isFluxerFlutterClient} from '../utils/UserAgentUtils';
 
 function resolveProviderSecret(
 	config: InstanceCaptchaEffectiveConfig,
@@ -88,9 +87,3 @@ export const CaptchaMiddleware = createMiddleware<HonoEnv>(async (ctx, next) =>
 	await verifyCaptchaToken(ctx);
 	await next();
 });
-export const CaptchaMiddlewareSkipFlutter = createMiddleware<HonoEnv>(async (ctx, next) => {
-	if (!isFluxerFlutterClient(ctx.req.raw)) {
-		await verifyCaptchaToken(ctx);
-	}
-	await next();
-});