server verify bugfix (#1488)

prosopo · Oct 30, 2024 · 0e086b9 · 0e086b9
1 parent cb064a7
commit 0e086b9
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/packages/provider/src/tasks/powCaptcha/powTasks.ts b/packages/provider/src/tasks/powCaptcha/powTasks.ts
@@ -13,7 +13,11 @@
 // limitations under the License.
 import type { KeyringPair } from "@polkadot/keyring/types";
 import { stringToHex, u8aToHex } from "@polkadot/util";
-import { ProsopoEnvError, getLoggerDefault } from "@prosopo/common";
+import {
+	ProsopoApiError,
+	ProsopoEnvError,
+	getLoggerDefault,
+} from "@prosopo/common";
 import {
 	ApiParams,
 	type CaptchaResult,
@@ -179,6 +183,15 @@ export class PowCaptchaManager {
 			});
 		}
 
+		if (challengeRecord.result.status !== CaptchaStatus.approved) {
+			throw new ProsopoApiError("CAPTCHA.INVALID_SOLUTION", {
+				context: {
+					failedFuncName: this.serverVerifyPowCaptchaSolution.name,
+					challenge,
+				},
+			});
+		}
+
 		if (challengeRecord.serverChecked) return false;
 
 		const challengeDappAccount = challengeRecord.dappAccount;

diff --git a/packages/provider/src/tests/unit/tasks/powCaptcha/powTasks.unit.test.ts b/packages/provider/src/tests/unit/tasks/powCaptcha/powTasks.unit.test.ts
@@ -291,6 +291,7 @@ describe("PowCaptchaManager", () => {
 				userAccount,
 				timestamp,
 				checked: false,
+				result: { status: CaptchaStatus.approved },
 			};
 			// biome-ignore lint/suspicious/noExplicitAny: TODO fix
 			(db.getPowCaptchaRecordByChallenge as any).mockResolvedValue(