From ebcad81da37bf1bc2c15019674b3b554df659fd2 Mon Sep 17 00:00:00 2001
From: GTPSHAX <rafiehasannudin@gmail.com>
Date: Wed, 6 May 2026 01:39:42 +0700
Subject: [PATCH 1/3] feat: validate hCaptcha response before document
 generation

---
 packages/handlers/handle-generate-docx.js | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/packages/handlers/handle-generate-docx.js b/packages/handlers/handle-generate-docx.js
index faa488e..4090734 100644
--- a/packages/handlers/handle-generate-docx.js
+++ b/packages/handlers/handle-generate-docx.js
@@ -126,9 +126,6 @@ function buildRencanaKegiatan (body, kegiatanKeys) {
  */
 const handleGenerateDocx = async (body) => {
   // Validate hCaptcha response before proceeding with document generation
-  if (!body['h-captcha-response']) {
-    return { status: 400, message: 'hCaptcha response token is missing' }
-  }
   if (!await handleHCaptchaValidation(body)) {
     return { status: 400, message: 'hCaptcha validation failed' }
   }

From cf16065abff41894cd732c6ea2d2e585408fbfac Mon Sep 17 00:00:00 2001
From: GTPSHAX <rafiehasannudin@gmail.com>
Date: Wed, 6 May 2026 01:45:08 +0700
Subject: [PATCH 2/3] feat: rearrange hCaptcha validation logic for improved
 error handling

---
 packages/handlers/handle-hcaptcha-validation.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/packages/handlers/handle-hcaptcha-validation.js b/packages/handlers/handle-hcaptcha-validation.js
index 7852f78..e4ed325 100644
--- a/packages/handlers/handle-hcaptcha-validation.js
+++ b/packages/handlers/handle-hcaptcha-validation.js
@@ -6,8 +6,17 @@ import { verify } from 'hcaptcha'
  * @returns {Promise<boolean>} - A promise that resolves to true if the hCaptcha validation is successful, or false otherwise.
  */
 const handleHCaptchaValidation = async (body) => {
-  const { 'h-captcha-response': hCaptchaResponse } = body
   const secret = String(process.env.HCAPTCHA_SECRET_KEY)
+  if (!secret) {
+    console.warn('Bypassing hCaptcha validation because HCAPTCHA_SECRET_KEY is not set in environment variables.')
+    return true
+  }
+
+  const { 'h-captcha-response': hCaptchaResponse } = body
+  if (!hCaptchaResponse) {
+    console.warn('hCaptcha response token is missing in the request body.')
+    return false
+  }
 
   try {
     const result = await verify(secret, hCaptchaResponse)

From 13215380bd96ffe1b10cef4d5e35741ea35a7593 Mon Sep 17 00:00:00 2001
From: GTPSHAX <rafiehasannudin@gmail.com>
Date: Wed, 6 May 2026 01:46:04 +0700
Subject: [PATCH 3/3] feat: add conditional rendering for hCaptcha integration

---
 resources/views/home.ejs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/resources/views/home.ejs b/resources/views/home.ejs
index a9c604b..34be33f 100644
--- a/resources/views/home.ejs
+++ b/resources/views/home.ejs
@@ -376,7 +376,11 @@
           <span>Export Template</span>
         </button>
       </div>
-      <div class="h-captcha mt-4" data-sitekey="<%= META.HCAPTCHA_SITE_KEY %>"></div>
+
+      <% if (META.HCAPTCHA_SITE_KEY) { %>
+        <div class="h-captcha mt-4" data-sitekey="<%= META.HCAPTCHA_SITE_KEY %>"></div>
+      <% } %>
+      
       <button id="rppFormSubmitBtn" type="submit" class="w-full mt-4 p-2 bg-green-600 text-white px-4 py-2 rounded-md hover:bg-green-700 focus:outline-none focus:ring-2 focus:ring-green-700 focus:ring-offset-2">
         <span>Buat Dokumen</span>
       </button>
@@ -390,7 +394,9 @@
     </div>
   </template>
 
-  <script src="https://js.hcaptcha.com/1/api.js" async defer></script>
+  <% if (META.HCAPTCHA_SITE_KEY) { %>
+    <script src="https://js.hcaptcha.com/1/api.js" async defer></script>
+  <% } %>
   <script src="/js/SwalWrapper.js"></script>
   <script src="/js/loading-indicator.js"></script>
   <script src="/js/home.js"></script>