Disable `registrations` flag in /api/v1/instance when CAPTCHA is enabled

This is to avoid apps trying and failing at using the registrations API,
which does not let us require a CAPTCHA and cannot be clearly signaled as
unavailable.

diff --git a/app/serializers/rest/instance_serializer.rb b/app/serializers/rest/instance_serializer.rb
index 48bbb55c8180cc571d0de97b02fab0821a6ddd57..94cc3ffe34e9354b582b5a78722aafbae8b85317 100644 (file)
--- a/app/serializers/rest/instance_serializer.rb
+++ b/app/serializers/rest/instance_serializer.rb
@@ -98,7 +98,7 @@ class REST::InstanceSerializer < ActiveModel::Serializer
   end
 
   def registrations
-    Setting.registrations_mode != 'none' && !Rails.configuration.x.single_user_mode
+    Setting.registrations_mode != 'none' && !Rails.configuration.x.single_user_mode && !captcha_enabled?
   end
 
   def approval_required
@@ -114,4 +114,8 @@ class REST::InstanceSerializer < ActiveModel::Serializer
   def instance_presenter
     @instance_presenter ||= InstancePresenter.new
   end
+
+  def captcha_enabled?
+    ENV['HCAPTCHA_SECRET_KEY'].present? && ENV['HCAPTCHA_SITE_KEY'].present? && Setting.captcha_enabled
+  end
 end

diff --git a/config/locales-glitch/en.yml b/config/locales-glitch/en.yml
index c96f21c92debbcd467b76ebf1bbcc47937f07d11..9bd66c969fc6af2c7fe8bfd916f6325e1413363f 100644 (file)
--- a/config/locales-glitch/en.yml
+++ b/config/locales-glitch/en.yml
@@ -3,7 +3,7 @@ en:
   admin:
     settings:
       captcha_enabled:
-        desc_html: Enable hCaptcha integration, requiring new users to solve a challenge when signing up. Note that this disables app-based registration, and requires third-party scripts from hCaptcha to be embedded in the registration pages. This may have security and privacy concerns.
+        desc_html: Enable hCaptcha integration, requiring new users to solve a challenge when signing up. Note that this disables app-based registration, may prevent your instance from being listed as having open registrations, and requires third-party scripts from hCaptcha to be embedded in the registration pages. This may have security and privacy concerns.
         title: Require new users to go through a CAPTCHA to sign up
       enable_keybase:
         desc_html: Allow your users to prove their identity via keybase