SDP-2009: Add endpoint for fetch captcha config by JiahuiWho · Pull Request #1052 · stellar/stellar-disbursement-platform-backend

JiahuiWho · 2026-02-11T15:23:20Z

What

Add /app-config endpoint to fetch captcha config for FE use
Changeforgot_password_handler.go to check IsCAPTCHADisabled() instead of env var h.ReCAPTCHADisabled, which is only the env-level flag.

Why

reCAPTCHA v3

Known limitations

To test reCAPTCHA v3 locally, you will need to update .env with

CAPTCHA_TYPE="GOOGLE_RECAPTCHA_V3"
RECAPTCHA_SITE_KEY="6LcgOWcsAAAAAJkeyQHEW4-yA-Eu79kYHDYXeznF"
RECAPTCHA_SITE_SECRET_KEY="6LcgOWcsAAAAACGUHDBr7VpcZ_C5BUjRPuBk9EUP"

and env-config-testnet.js (the nginx)with

RECAPTCHA_SITE_KEY: "6LcgOWcsAAAAAJkeyQHEW4-yA-Eu79kYHDYXeznF",

Checklist

Title follows SDP-1234: Add new feature or Chore: Refactor package xyz format. The Jira ticket code was included if available.
PR has a focused scope and doesn't mix features with refactoring
Tests are included (if applicable)
CHANGELOG.md is updated (if applicable)
If contracts changed, run the Contract WASM Artifacts workflow and open a PR to update the WASMs on dev
CONFIG/SECRETS changes are updated in helmcharts and deployments (if applicable)
Preview deployment works as expected
Ready for production

stellar-jenkins · 2026-02-11T15:29:22Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1052.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1052.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1052.previews.kube001.services.stellar-ops.com

internal/serve/validators/recaptcha_v3.go

Copilot

Pull request overview

Adds a public endpoint to expose CAPTCHA configuration to the frontend and updates password-reset flow to respect organization-level CAPTCHA disablement (not just env-level flags), as part of reCAPTCHA v3 support.

Changes:

Add GET /organization/captcha-config to return CAPTCHA type and whether CAPTCHA is disabled for a given organization.
Update forgot-password handler (and tests) to use IsCAPTCHADisabled() for org-level override behavior.
Adjust dev/testnet configuration and document the change in CHANGELOG.md.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
internal/serve/validators/recaptcha_v3.go	Adds debug prints during v3 verification flow.
internal/serve/serve.go	Registers new `/organization/captcha-config` route.
internal/serve/httphandler/forgot_password_handler.go	Uses org-aware CAPTCHA disablement checks in validation + execution.
internal/serve/httphandler/forgot_password_handler_test.go	Updates unit test to pass context and set org-level CAPTCHA flag in DB.
internal/serve/httphandler/captcha_config_handler.go	Implements the new public handler resolving tenant + org-level CAPTCHA flag.
internal/serve/httphandler/captcha_config_handler_test.go	Adds handler test coverage for missing org name, unknown org, and override behavior.
dev/env-config-testnet.js	Updates testnet RECAPTCHA site key used by the dev frontend config.
dev/docker-compose-sdp.yml	Exposes `CAPTCHA_TYPE` env var in local docker-compose.
CHANGELOG.md	Adds entry for the new endpoint.

internal/serve/serve.go

dev/docker-compose-sdp.yml

internal/serve/validators/recaptcha_v3.go

internal/serve/httphandler/captcha_config_handler.go

internal/serve/httphandler/forgot_password_handler.go

stellar-jenkins · 2026-02-11T15:38:25Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1052.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1052.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1052.previews.kube001.services.stellar-ops.com

stellar-jenkins · 2026-02-11T18:35:13Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1052.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1052.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1052.previews.kube001.services.stellar-ops.com

stellar-jenkins · 2026-02-11T18:59:59Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1052.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1052.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1052.previews.kube001.services.stellar-ops.com

internal/serve/serve.go

internal/serve/httphandler/captcha_config_handler.go

stellar-jenkins · 2026-02-12T19:31:49Z

stellar-disbursement-platform-backend-preview is available here:
SDP: https://sdp-backend-pr1052.previews.kube001.services.stellar-ops.com/health
AP: https://sdp-ap-pr1052.previews.kube001.services.stellar-ops.com/health
Frontend: https://sdp-backend-dashboard-pr1052.previews.kube001.services.stellar-ops.com

philipliu · 2026-02-12T21:28:53Z

dev/docker-compose-sdp.yml

      SEP10_CLIENT_ATTRIBUTION_REQUIRED: ${SEP10_CLIENT_ATTRIBUTION_REQUIRED:-true}
      DISTRIBUTION_PUBLIC_KEY: ${DISTRIBUTION_PUBLIC_KEY}
      DISTRIBUTION_SEED: ${DISTRIBUTION_SEED}
+      CAPTCHA_TYPE: ${CAPTCHA_TYPE:-GOOGLE_RECAPTCHA_V2}


V3 is a lot less annoying. That could be the default?

Also wondering if we need to touch the other Docker Compose files or the .env.example.

I was thinking of handling it in a separate PR. If we’re making v3 the default, we should update all at once (CAPTCHA_TYPE defaults, the wizard script, README etc). Also note there's no public test keys for v3 , we also need to throw error if user try to enable reCAPTCHA when no site key is provided

All the other docker files don't reference any CAPTCHA vars at all so no need to change.

add new endpoint and fix forgot password

50e5a52

JiahuiWho temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 11, 2026 15:23 — with GitHub Actions Inactive

JiahuiWho temporarily deployed to Internal SEP Tests February 11, 2026 15:23 — with GitHub Actions Inactive

github-actions bot assigned JiahuiWho Feb 11, 2026

Merge branch 'develop' into sdp-2009-add-public-endpoint

aeeb3d6

JiahuiWho temporarily deployed to Internal SEP Tests February 11, 2026 15:23 — with GitHub Actions Inactive

JiahuiWho temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 11, 2026 15:23 — with GitHub Actions Inactive

JiahuiWho temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 11, 2026 15:26 — with GitHub Actions Inactive

JiahuiWho temporarily deployed to Internal SEP Tests February 11, 2026 15:26 — with GitHub Actions Inactive

JiahuiWho changed the title ~~[SDP-2009] Add endpoint for fetch captcha config~~ SDP-2009: Add endpoint for fetch captcha config Feb 11, 2026

JiahuiWho marked this pull request as ready for review February 11, 2026 15:29

Copilot AI review requested due to automatic review settings February 11, 2026 15:29

Copilot started reviewing on behalf of JiahuiWho February 11, 2026 15:30 View session

github-advanced-security bot found potential problems Feb 11, 2026

View reviewed changes

internal/serve/validators/recaptcha_v3.go Fixed Show fixed Hide fixed

internal/serve/validators/recaptcha_v3.go Fixed Show fixed Hide fixed

changelog

a77093b

Copilot AI reviewed Feb 11, 2026

View reviewed changes

JiahuiWho force-pushed the sdp-2009-add-public-endpoint branch from 3132636 to a77093b Compare February 11, 2026 15:35

JiahuiWho temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 11, 2026 15:35 — with GitHub Actions Inactive

JiahuiWho temporarily deployed to Internal SEP Tests February 11, 2026 15:35 — with GitHub Actions Inactive

support single tenant mode

74c6120

JiahuiWho temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 11, 2026 18:32 — with GitHub Actions Inactive

JiahuiWho temporarily deployed to Internal SEP Tests February 11, 2026 18:32 — with GitHub Actions Inactive

Merge branch 'develop' into sdp-2009-add-public-endpoint

8b5eb0d

JiahuiWho temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 11, 2026 18:56 — with GitHub Actions Inactive

JiahuiWho temporarily deployed to Internal SEP Tests February 11, 2026 18:56 — with GitHub Actions Inactive

marwen-abid reviewed Feb 11, 2026

View reviewed changes

internal/serve/serve.go Outdated Show resolved Hide resolved

internal/serve/httphandler/captcha_config_handler.go Outdated Show resolved Hide resolved

internal/serve/httphandler/captcha_config_handler.go Outdated Show resolved Hide resolved

comments

df83cad

JiahuiWho temporarily deployed to Internal SEP Tests February 12, 2026 19:28 — with GitHub Actions Inactive

JiahuiWho had a problem deploying to Receiver Registration - E2E Integration Tests (Stellar) February 12, 2026 19:28 — with GitHub Actions Failure

JiahuiWho had a problem deploying to Receiver Registration - E2E Integration Tests (Stellar) February 12, 2026 19:34 — with GitHub Actions Failure

JiahuiWho temporarily deployed to Receiver Registration - E2E Integration Tests (Stellar) February 12, 2026 19:37 — with GitHub Actions Inactive

philipliu approved these changes Feb 12, 2026

View reviewed changes

philipliu reviewed Feb 12, 2026

View reviewed changes

JiahuiWho merged commit f7efd7e into develop Feb 12, 2026
17 of 19 checks passed

JiahuiWho deleted the sdp-2009-add-public-endpoint branch February 12, 2026 22:10

Conversation

JiahuiWho commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Known limitations

Checklist

Uh oh!

stellar-jenkins commented Feb 11, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stellar-jenkins commented Feb 11, 2026

Uh oh!

stellar-jenkins commented Feb 11, 2026

Uh oh!

stellar-jenkins commented Feb 11, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stellar-jenkins commented Feb 12, 2026

Uh oh!

philipliu Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

philipliu Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

JiahuiWho Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

JiahuiWho commented Feb 11, 2026 •

edited

Loading

JiahuiWho Feb 12, 2026 •

edited

Loading