hanna/fabrica

feat(web): captcha on sign-up and SSH/GPG key management in settings

cf3b331 · hanna committed on 2026-07-25

Add an optional [captcha] config table (none | hcaptcha | recaptcha, site_key,
secret_key); when enabled the provider widget renders on /register and the
solved token is verified server-side via reqwest (native-tls) before any store
write, failing closed. This is a documented opt-in exception to §9.5. Also
surface the existing key store in account settings: list/add/delete SSH and GPG
keys (reusing git::parse_public_key for validation, dup-checked, ownership-
checked on delete) via /settings/keys[/delete]. Closes the last §19 gap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +108 −0

Cargo.toml +7 −0

assets/base.css +17 −0

crates/config/src/lib.rs +2 −2

crates/config/src/types.rs +85 −0

crates/web/Cargo.toml +1 −0

crates/web/src/lib.rs +2 −0

crates/web/src/pages.rs +257 −7

crates/web/src/tests.rs +173 −0

docs/decisions.md +28 −0

  "pin-project-lite",
  "smallvec",
  "tokio",
+ "want",
+]
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
 [[package]]
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
+ "base64",
  "bytes",
+ "futures-channel",
+ "futures-util",
  "http",
  "http-body",
  "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
  "pin-project-lite",
+ "socket2",
  "tokio",
  "tower-service",
+ "tracing",
+]
 [[package]]
+]
 [[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+[[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51743d3e274e2b18df81c4dc6caf8a5b8e15dbe799e0dca05c7617380094e884"
 [[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-tls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "native-tls",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-native-tls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+[[package]]
 name = "rfc6979"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+[[package]]
 name = "rustversion"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
 [[package]]
 name = "synstructure"
  "bitflags",
  "bytes",
  "futures-core",
+ "futures-util",
  "http",
  "http-body",
  "pin-project-lite",
  "tokio",
  "tokio-util",
+ "tower",
  "tower-layer",
  "tower-service",
  "tracing",
+ "url",
  "uuid",
+]
 checksum = "009994f150cc0cd50ff54917d5bc8bffe8cad10ca10d81c34da2ec421ae61782"
 [[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+[[package]]
 name = "twofish"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+[[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
  "maud",
  "mime_guess",
  "model",
+ "reqwest",
  "rust-embed",
  "serde",
  "serde_json",
+]
 [[package]]
+name = "web-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+[[package]]
 name = "web-time"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"

 flate2 = "1"
 # Content search (ripgrep's engine). Dual Unlicense/MIT — MIT satisfies the gate.
 grep = "0.3"
+# Outbound HTTP for optional captcha verification only. native-tls (system
+# OpenSSL, already a build input) not rustls, so `ring` stays out of the graph;
+# http2/charset off to keep the tree small. See docs/decisions.md.
+reqwest = { version = "0.12", default-features = false, features = [
+    "native-tls",
+    "json",
+] }
 # SSH server (default features: aws-lc-rs backend, no ring; re-exports ssh-key).
 russh = "0.62"
 tracing = "0.1"

 .token-list {
   margin-bottom: 1rem;
+}
+.key-list {
+  margin-bottom: 1rem;
+}
+.key-add textarea {
+  font-family: var(--fb-font-mono);
+}
+.key-add-row {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  margin-bottom: 0.5rem;
+}
+.key-add-row select,
+.key-add-row input {
+  width: auto;
+}
 .token-scopes {
   margin: 0.75rem 0 0;
   padding: 0.5rem 0.85rem;

 pub use crate::secret::{REDACTED, Secret};
 pub use crate::types::{
-    Auth, Config, Database, DefaultVisibility, Git, Instance, Log, LogFormat, LogLevel, Mail,
+    Auth, Captcha, CaptchaProvider, Config, Database, DefaultVisibility, Git, Instance, Log,
-    MailBackend, MailEncryption, Search, Server, Ssh, Storage, Ui,
+    LogFormat, LogLevel, Mail, MailBackend, MailEncryption, Search, Server, Ssh, Storage, Ui,
 };
 /// System-wide configuration path, the lowest-priority file source.

     pub auth: Auth,
     /// Outbound mail.
     pub mail: Mail,
+    /// Optional bot mitigation on self-registration.
+    #[serde(default)]
+    pub captcha: Captcha,
     /// Web UI presentation.
     pub ui: Ui,
     /// Git binary and pack-transport limits.
+    }
+}
+/// A supported captcha provider for the sign-up form.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum CaptchaProvider {
+    /// No captcha (the default).
+    #[default]
+    None,
+    /// [hCaptcha](https://www.hcaptcha.com).
+    HCaptcha,
+    /// Google [reCAPTCHA](https://developers.google.com/recaptcha) v2.
+    ReCaptcha,
+}
+impl CaptchaProvider {
+    /// The browser widget script URL, or `None` for [`CaptchaProvider::None`].
+    #[must_use]
+    pub fn script_url(self) -> Option<&'static str> {
+        match self {
+            Self::None => None,
+            Self::HCaptcha => Some("https://js.hcaptcha.com/1/api.js"),
+            Self::ReCaptcha => Some("https://www.google.com/recaptcha/api.js"),
+        }
+    }
+    /// The CSS class the widget script looks for to render the challenge.
+    #[must_use]
+    pub fn widget_class(self) -> &'static str {
+        match self {
+            Self::None | Self::HCaptcha => "h-captcha",
+            Self::ReCaptcha => "g-recaptcha",
+        }
+    }
+    /// The form field the widget populates with the solved token.
+    #[must_use]
+    pub fn response_field(self) -> &'static str {
+        match self {
+            Self::None | Self::HCaptcha => "h-captcha-response",
+            Self::ReCaptcha => "g-recaptcha-response",
+        }
+    }
+    /// The server-side verification endpoint.
+    #[must_use]
+    pub fn verify_url(self) -> &'static str {
+        match self {
+            Self::None | Self::HCaptcha => "https://api.hcaptcha.com/siteverify",
+            Self::ReCaptcha => "https://www.google.com/recaptcha/api/siteverify",
+        }
+    }
+}
+/// `[captcha]` — optional bot mitigation on the sign-up form.
+///
+/// Off by default. Enabling it is a deliberate, opt-in exception to the "no
+/// third-party network requests from any page" rule (§9.5): the chosen provider's
+/// widget script loads on `/register` and the server verifies the solved token
+/// out-of-band. See `docs/decisions.md`.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Captcha {
+    /// Which provider to use (or `none`, the default).
+    #[serde(default)]
+    pub provider: CaptchaProvider,
+    /// The public site key embedded in the page.
+    #[serde(default)]
+    pub site_key: String,
+    /// The provider secret used for server-side verification.
+    #[serde(default)]
+    pub secret_key: Option<Secret>,
+}
+impl Captcha {
+    /// Whether captcha is fully configured and should be enforced on sign-up.
+    #[must_use]
+    pub fn enabled(&self) -> bool {
+        self.provider != CaptchaProvider::None
+            && !self.site_key.is_empty()
+            && self.secret_key.is_some()
+    }
+}
 /// `[server]` — HTTP binding and limits.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]

 tokio-util = { workspace = true }
 flate2 = { workspace = true }
 grep = { workspace = true }
+reqwest = { workspace = true }
 base64 = { workspace = true }
 time = { workspace = true }
 serde = { workspace = true }

         .route("/settings/password", post(pages::account_password))
         .route("/settings/tokens", post(pages::token_create))
         .route("/settings/tokens/revoke", post(pages::token_revoke))
+        .route("/settings/keys", post(pages::key_add))
+        .route("/settings/keys/delete", post(pages::key_delete))
         .route("/settings/avatar", post(avatar::upload))
         .route("/settings/theme", get(pages::set_theme))
         .route("/avatar/{username}", get(avatar::show))

 use axum::http::{HeaderMap, Uri, header};
 use axum::response::{IntoResponse, Redirect, Response};
 use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
-use maud::{Markup, html};
+use maud::{Markup, PreEscaped, html};
 use model::User;
 use serde::Deserialize;
     /// Confirmation.
     #[serde(default)]
     confirm: String,
+    /// hCaptcha solved token (populated by the hCaptcha widget).
+    #[serde(default, rename = "h-captcha-response")]
+    hcaptcha_response: String,
+    /// reCAPTCHA solved token (populated by the reCAPTCHA widget).
+    #[serde(default, rename = "g-recaptcha-response")]
+    grecaptcha_response: String,
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
+}
+/// The captcha provider and public site key when captcha is enabled, for
+/// rendering the widget on the sign-up form.
+fn captcha_view(cfg: &config::Config) -> Option<(config::CaptchaProvider, String)> {
+    cfg.captcha
+        .enabled()
+        .then(|| (cfg.captcha.provider, cfg.captcha.site_key.clone()))
+}
 /// `GET /register` — the sign-up form, or `404` when registration is disabled.
 pub async fn register_form(
     State(state): State<AppState>,
         return Redirect::to("/").into_response();
+    }
     let (jar, chrome) = build_chrome(&state, jar, None, uri.path().to_string());
-    let body = register_body(&chrome.csrf, None, "", "");
+    let body = register_body(
+        &chrome.csrf,
+        None,
+        "",
+        "",
+        captcha_view(&state.config).as_ref(),
+    );
     (jar, page(&chrome, "Sign up", body)).into_response()
+}
-/// Render the sign-up form with an optional error and prefilled fields.
+/// Render the sign-up form with an optional error, prefilled fields, and the
-fn register_body(csrf: &str, error: Option<&str>, username: &str, email: &str) -> Markup {
+/// captcha widget when one is configured.
+fn register_body(
+    csrf: &str,
+    error: Option<&str>,
+    username: &str,
+    email: &str,
+    captcha: Option<&(config::CaptchaProvider, String)>,
+) -> Markup {
     html! {
         div class="auth-wrap" {
             div class="auth-card" {
                     label for="confirm" { "Confirm password" }
                     input type="password" id="confirm" name="confirm"
                           autocomplete="new-password" required;
+                    @if let Some((provider, site_key)) = captcha {
+                        @if let Some(script) = provider.script_url() {
+                            (PreEscaped(format!("<script src=\"{script}\" async defer></script>")))
+                            div class=(provider.widget_class()) data-sitekey=(site_key) {}
+                        }
+                    }
                     button class="btn btn-primary" type="submit" { "Create account" }
+                }
                 p class="muted auth-alt" { "Already have an account? " a href="/login" { "Sign in" } }
     let username = form.username.trim().to_string();
     let email = form.email.trim().to_string();
+    let captcha = captcha_view(&state.config);
     let reject = |msg: &str, username: &str, email: &str| {
         let (jar, chrome) = build_chrome(&state, jar.clone(), None, "/register".to_string());
-        let body = register_body(&chrome.csrf, Some(msg), username, email);
+        let body = register_body(&chrome.csrf, Some(msg), username, email, captcha.as_ref());
+        (
             axum::http::StatusCode::BAD_REQUEST,
             jar,
         return reject("Password must be at least 8 characters.", &username, &email);
+    }
+    // When captcha is enabled, the solved token must verify with the provider
+    // before we touch the store.
+    if state.config.captcha.enabled() {
+        let token = match state.config.captcha.provider {
+            config::CaptchaProvider::ReCaptcha => form.grecaptcha_response.trim(),
+            _ => form.hcaptcha_response.trim(),
+        };
+        if !verify_captcha(&state.config.captcha, token).await {
+            return reject(
+                "Captcha verification failed. Please try again.",
+                &username,
+                &email,
+            );
+        }
+    }
     let params = auth::HashParams {
         m_cost: state.config.auth.argon2_m_cost,
         t_cost: state.config.auth.argon2_t_cost,
+    }
+}
+/// The relevant fields of a provider `siteverify` response.
+#[derive(Debug, Deserialize)]
+struct SiteVerify {
+    /// Whether the token was valid.
+    #[serde(default)]
+    success: bool,
+}
+/// Verify a solved captcha `token` with the configured provider. Returns `false`
+/// on an empty token, a missing secret, a network error, or a rejected token — a
+/// closed failure mode, so a broken verifier never lets a bot through.
+async fn verify_captcha(cfg: &config::Captcha, token: &str) -> bool {
+    if token.is_empty() {
+        return false;
+    }
+    let Some(secret) = cfg.secret_key.as_ref() else {
+        return false;
+    };
+    let Ok(client) = reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(10))
+        .build()
+    else {
+        return false;
+    };
+    let form = [("secret", secret.expose()), ("response", token)];
+    match client
+        .post(cfg.provider.verify_url())
+        .form(&form)
+        .send()
+        .await
+    {
+        Ok(resp) => resp.json::<SiteVerify>().await.is_ok_and(|v| v.success),
+        Err(_) => false,
+    }
+}
 /// Logout form field.
 #[derive(Debug, Deserialize)]
 pub struct CsrfForm {
     uri: Uri,
 ) -> AppResult<Response> {
     let tokens = state.store.tokens_by_user(&user.id).await?;
+    let keys = state.store.keys_by_user(&user.id).await?;
     let (jar, chrome) = build_chrome(&state, jar, Some(user.clone()), uri.path().to_string());
-    let body = settings_body(&user, &chrome.csrf, &tokens, None);
+    let body = settings_body(&user, &chrome.csrf, &tokens, &keys, None);
     Ok((jar, page(&chrome, "Settings", body)).into_response())
+}
                 .tokens_by_user(&user.id)
                 .await
                 .unwrap_or_default();
+            let keys = state.store.keys_by_user(&user.id).await.unwrap_or_default();
             let (jar, chrome) =
                 build_chrome(&state, jar, Some(user.clone()), "/settings".to_string());
-            let body = settings_body(&user, &chrome.csrf, &tokens, Some(&jwt));
+            let body = settings_body(&user, &chrome.csrf, &tokens, &keys, Some(&jwt));
             (jar, page(&chrome, "Settings", body)).into_response()
+        }
         Err(err) => err.into_response(),
     Redirect::to("/settings").into_response()
+}
+/// The add-key form.
+#[derive(Debug, Deserialize)]
+pub struct KeyAddForm {
+    /// `ssh` or `gpg`.
+    #[serde(default)]
+    kind: String,
+    /// Optional label.
+    #[serde(default)]
+    name: String,
+    /// The public key material (`authorized_keys` line or armored block).
+    #[serde(default)]
+    key: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /settings/keys` — register an SSH or GPG public key for the viewer.
+pub async fn key_add(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<KeyAddForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let Some(kind) = model::KeyKind::from_token(&form.kind) else {
+        return AppError::BadRequest("Choose a key type.".to_string()).into_response();
+    };
+    let material = form.key.trim();
+    let Ok(parsed) = git::parse_public_key(kind, material) else {
+        return AppError::BadRequest(format!("That does not look like a valid {kind} key."))
+            .into_response();
+    };
+    // Reject a duplicate fingerprint (registered to anyone).
+    match state
+        .store
+        .key_by_fingerprint(kind, &parsed.fingerprint)
+        .await
+    {
+        Ok(Some(_)) => {
+            return AppError::BadRequest("That key is already registered.".to_string())
+                .into_response();
+        }
+        Ok(None) => {}
+        Err(err) => return AppError::from(err).into_response(),
+    }
+    let name = form.name.trim();
+    let label = (!name.is_empty())
+        .then(|| name.to_string())
+        .or(parsed.label);
+    match state
+        .store
+        .create_key(store::NewKey {
+            user_id: user.id.clone(),
+            kind,
+            name: label,
+            fingerprint: parsed.fingerprint,
+            public_key: parsed.public_key,
+        })
+        .await
+    {
+        Ok(_) => Redirect::to("/settings").into_response(),
+        Err(store::StoreError::Conflict { .. }) => {
+            AppError::BadRequest("That key is already registered.".to_string()).into_response()
+        }
+        Err(err) => AppError::from(err).into_response(),
+    }
+}
+/// The delete-key form.
+#[derive(Debug, Deserialize)]
+pub struct KeyDeleteForm {
+    /// The key id.
+    #[serde(default)]
+    id: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /settings/keys/delete` — delete one of the viewer's keys.
+pub async fn key_delete(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<KeyDeleteForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    // Only delete a key that belongs to the viewer.
+    let owned = state
+        .store
+        .keys_by_user(&user.id)
+        .await
+        .is_ok_and(|keys| keys.iter().any(|k| k.id == form.id));
+    if owned {
+        let _ = state.store.delete_key(&form.id).await;
+    }
+    Redirect::to("/settings").into_response()
+}
 /// Render the settings page: avatar, profile, account credentials, and tokens.
 fn settings_body(
     user: &User,
     csrf: &str,
     tokens: &[model::ApiToken],
+    keys: &[model::Key],
     new_token: Option<&str>,
 ) -> Markup {
     let val = |v: &Option<String>| v.clone().unwrap_or_default();
+                }
+            }
+        }
+        (keys_section(csrf, keys))
         (tokens_section(csrf, tokens, new_token))
+    }
+}
+/// The SSH and GPG keys settings section.
+fn keys_section(csrf: &str, keys: &[model::Key]) -> Markup {
+    html! {
+        section class="listing" {
+            h2 { "SSH and GPG keys" }
+            div class="card" {
+                p class="muted field-hint" {
+                    "SSH keys authorize push over SSH; both SSH and GPG keys verify commit signatures."
+                }
+                @if keys.is_empty() {
+                    p class="muted" { "No keys yet." }
+                } @else {
+                    ul class="entry-list key-list" {
+                        @for k in keys {
+                            li class="entry-row" {
+                                div class="entry-row-body" {
+                                    span class="entry-row-title" {
+                                        span class="badge" { (k.kind.as_str()) }
+                                        " " (k.name.as_deref().unwrap_or("(unnamed)"))
+                                    }
+                                    div class="entry-row-meta muted mono" { (k.fingerprint) }
+                                }
+                                div class="entry-row-actions" {
+                                    form method="post" action="/settings/keys/delete" {
+                                        input type="hidden" name="_csrf" value=(csrf);
+                                        input type="hidden" name="id" value=(k.id);
+                                        button class="btn btn-danger" type="submit" { "Delete" }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                form class="key-add" method="post" action="/settings/keys" {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    div class="key-add-row" {
+                        label for="key_kind" { "Type" }
+                        select id="key_kind" name="kind" {
+                            option value="ssh" { "SSH" }
+                            option value="gpg" { "GPG" }
+                        }
+                        label for="key_name" { "Title" }
+                        input type="text" id="key_name" name="name" placeholder="Optional label";
+                    }
+                    label for="key_material" { "Key" }
+                    textarea id="key_material" name="key" rows="4" required
+                             placeholder="Paste an SSH public key or an ASCII-armored GPG public key" {}
+                    button class="btn btn-primary" type="submit" { "Add key" }
+                }
+            }
+        }
+    }
+}
 /// The API tokens settings section.
 fn tokens_section(csrf: &str, tokens: &[model::ApiToken], new_token: Option<&str>) -> Markup {
     html! {

     assert_eq!(res.status(), StatusCode::SEE_OTHER);
     assert_eq!(res.headers().get(header::LOCATION).unwrap(), "/login");
+}
+/// A valid SSH public key for exercising the key-management UI.
+const TEST_SSH_KEY: &str = "ssh-ed25519 \
+AAAAC3NzaC1lZDI1NTE5AAAAIJqq6nD0E4SlM+xw1UVOompehxQE8sUYCVoyV+NBjfKU web-test@fabrica";
+#[tokio::test]
+async fn settings_keys_add_list_and_delete() {
+    let (state, app) = app().await;
+    let cookie = login(&app).await;
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    // The settings page shows the keys section.
+    let req = Request::builder()
+        .uri("/settings")
+        .header(header::COOKIE, cookie.clone())
+        .body(Body::empty())
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    assert!(body_string(res).await.contains("SSH and GPG keys"));
+    // Add an SSH key.
+    let body = format!(
+        "kind=ssh&name=laptop&key={}&_csrf={token}",
+        urlencoding(TEST_SSH_KEY)
+    );
+    let req = Request::builder()
+        .method("POST")
+        .uri("/settings/keys")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie.clone())
+        .body(Body::from(body))
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let keys = state.store.keys_by_user(&ada.id).await.unwrap();
+    assert_eq!(keys.len(), 1, "key was stored");
+    let key_id = keys[0].id.clone();
+    // It renders on the settings page.
+    let req = Request::builder()
+        .uri("/settings")
+        .header(header::COOKIE, cookie.clone())
+        .body(Body::empty())
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert!(body_string(res).await.contains("laptop"), "key label shown");
+    // Delete it.
+    let req = Request::builder()
+        .method("POST")
+        .uri("/settings/keys/delete")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie)
+        .body(Body::from(format!("id={key_id}&_csrf={token}")))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    assert!(state.store.keys_by_user(&ada.id).await.unwrap().is_empty());
+}
+#[tokio::test]
+async fn settings_key_add_rejects_garbage() {
+    let (_state, app) = app().await;
+    let cookie = login(&app).await;
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    let req = Request::builder()
+        .method("POST")
+        .uri("/settings/keys")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie)
+        .body(Body::from(format!(
+            "kind=ssh&name=x&key=not-a-key&_csrf={token}"
+        )))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+}
+/// An app with hCaptcha configured, so the sign-up form must show and enforce it.
+async fn app_with_captcha() -> Router {
+    let store = Store::connect("sqlite::memory:", 1).await.unwrap();
+    store.migrate().await.unwrap();
+    let mut config = Config::default();
+    config.instance.name = "Forge".to_string();
+    config.instance.allow_registration = true;
+    config.auth.cookie_secure = false;
+    config.captcha.provider = config::CaptchaProvider::HCaptcha;
+    config.captcha.site_key = "test-site-key".to_string();
+    config.captcha.secret_key = Some(config::Secret::new("test-secret".to_string()));
+    let state = AppState::build(Arc::new(config), store, "test-secret".to_string()).unwrap();
+    crate::build_router(state)
+}
+#[tokio::test]
+async fn register_page_shows_the_captcha_widget() {
+    let app = app_with_captcha().await;
+    let res = app.oneshot(get("/register")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let html = body_string(res).await;
+    assert!(html.contains("js.hcaptcha.com"), "widget script present");
+    assert!(
+        html.contains("data-sitekey=\"test-site-key\""),
+        "site key present"
+    );
+    assert!(html.contains("h-captcha"), "widget container present");
+}
+#[tokio::test]
+async fn register_is_rejected_when_captcha_is_missing() {
+    let app = app_with_captcha().await;
+    let form = app.clone().oneshot(get("/register")).await.unwrap();
+    let cookie = form
+        .headers()
+        .get(header::SET_COOKIE)
+        .unwrap()
+        .to_str()
+        .unwrap()
+        .to_string();
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    // No captcha token in the body → rejected before any network call.
+    let req = Request::builder()
+        .method("POST")
+        .uri("/register")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, format!("fabrica_csrf={token}"))
+        .body(Body::from(format!(
+            "username=bot&email=bot@example.com&password=secret12&confirm=secret12&_csrf={token}"
+        )))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+    assert!(
+        body_string(res)
+            .await
+            .contains("Captcha verification failed")
+    );
+}
+/// Minimal application/x-www-form-urlencoded encoding for test bodies.
+fn urlencoding(s: &str) -> String {
+    use std::fmt::Write as _;
+    let mut out = String::with_capacity(s.len());
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            b' ' => out.push('+'),
+            _ => {
+                let _ = write!(out, "%{b:02X}");
+            }
+        }
+    }
+    out
+}

 uniform and avoids a parallel implementation. Merge via subprocess preserves the one code path
 for write operations. spec.md §§1, 18–19 and CLAUDE.md are updated to match; this is a large,
 multi-phase build delivered incrementally with the gate green at each step.
+## 2026-07-25 — Captcha on sign-up: an opt-in exception to "no network from pages"
+**Decision:** Implement the spec §19 optional captcha (hCaptcha / reCAPTCHA v2) on the
+`/register` form, off by default via a new `[captcha]` config table (`provider = none |
+hcaptcha | recaptcha`, `site_key`, `secret_key`). When — and only when — an admin enables it,
+the provider's widget script is loaded on the sign-up page and the solved token is verified
+server-side with an outbound HTTPS POST to the provider's `siteverify` endpoint. Verification
+**fails closed**: an empty token, a missing secret, a network error, or a rejected token all
+reject the sign-up, so a broken verifier never admits a bot. The HTTP call uses `reqwest`
+(`default-features = false`, `native-tls` + `json`) — native-tls, not rustls, so `ring` stays
+out of the graph, consistent with the mail/SSH TLS decisions.
+**Rationale:** captcha is fundamentally incompatible with §9.5 ("no network requests from any
+page") — it cannot work without third-party JS and an out-of-band verify. The spec nonetheless
+lists it as an optional feature, so the resolution is to make it a **deliberate, opt-in**
+deviation: the no-network invariant holds for every page by default, and enabling captcha is an
+explicit administrator choice to accept a third-party dependency on one page. No other page
+loads external resources.
+## 2026-07-25 — SSH/GPG key management in the web account settings
+**Decision:** Surface the existing key store (CLI phase 8) in the web settings page: an "SSH
+and GPG keys" section listing the viewer's keys with delete buttons and an add form (type +
+optional label + pasted material), backed by `POST /settings/keys` and `/settings/keys/delete`.
+The add handler reuses `git::parse_public_key` for validation and fingerprinting and rejects a
+duplicate fingerprint; delete is ownership-checked against `keys_by_user`. This closes the last
+account-settings gap (§19) so key management no longer requires shell access.