From c579925f038949ee9b7ccd174cc56ae3b42d0abb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois-Xavier=20Talbot?=
 <108630700+fetchfern@users.noreply.github.com>
Date: Sun, 19 Jul 2026 17:54:23 -0400
Subject: [PATCH] feat: honeypot signup field (#6776)

feat: account consent
---
 .../src/components/ui/auth/CreateAccount.vue  | 19 ++++++++++++++++---
 apps/frontend/src/pages/auth/create/oauth.vue |  3 ++-
 apps/frontend/src/pages/auth/sign-up.vue      |  3 ++-
 apps/labrinth/src/routes/internal/flows.rs    | 19 +++++++++++++++++++
 .../api-client/src/modules/labrinth/types.ts  |  2 ++
 5 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/apps/frontend/src/components/ui/auth/CreateAccount.vue b/apps/frontend/src/components/ui/auth/CreateAccount.vue
index a529e2a05f..412883acea 100644
--- a/apps/frontend/src/components/ui/auth/CreateAccount.vue
+++ b/apps/frontend/src/components/ui/auth/CreateAccount.vue
@@ -72,6 +72,18 @@
 			/>
 		</div>
 
+		<div class="hidden" aria-hidden="true">
+			<input
+				id="create-account-consent"
+				v-model="accountConsent"
+				name="account_consent"
+				type="checkbox"
+				tabindex="-1"
+				autocomplete="off"
+			/>
+			<label for="create-account-consent">I agree to receive account updates by email</label>
+		</div>
+
 		<ButtonStyled color="brand">
 			<button
 				class="!w-full font-bold"
@@ -97,7 +109,7 @@ import {
 	StyledInput,
 	useVIntl,
 } from '@modrinth/ui'
-import { computed } from 'vue'
+import { computed, ref } from 'vue'
 
 import HCaptcha from '@/components/ui/auth/HCaptcha.vue'
 
@@ -109,7 +121,7 @@ interface AuthGlobals {
 interface Props {
 	globals?: AuthGlobals | null
 	requiresDob?: boolean
-	onCompleteSignUp?: () => void
+	onCompleteSignUp?: (accountConsent: boolean) => void
 	onSetCaptchaRef?: ((captchaRef: unknown) => void) | undefined
 }
 
@@ -127,6 +139,7 @@ const dateOfBirthModel = defineModel<string | null>('dateOfBirth', { default: ''
 const usernameModel = defineModel<string>('username', { default: '' })
 const tokenModel = defineModel<string>('token', { default: '' })
 const subscribeModel = defineModel<boolean>('subscribe', { default: false })
+const accountConsent = ref(false)
 
 const maxInputDate = computed(() => `${new Date().getFullYear()}-12-31`)
 
@@ -198,7 +211,7 @@ function onCompleteSignUpClick() {
 		return
 	}
 
-	onCompleteSignUp()
+	onCompleteSignUp(accountConsent.value)
 }
 
 const messages = defineMessages({
diff --git a/apps/frontend/src/pages/auth/create/oauth.vue b/apps/frontend/src/pages/auth/create/oauth.vue
index d2bde7b193..96864382be 100644
--- a/apps/frontend/src/pages/auth/create/oauth.vue
+++ b/apps/frontend/src/pages/auth/create/oauth.vue
@@ -128,7 +128,7 @@ const { data: globals } = useQuery<AuthGlobalsResponse>({
 	},
 })
 
-async function completeOAuthSignUp() {
+async function completeOAuthSignUp(accountConsent: boolean) {
 	startLoading()
 	try {
 		if (!oauthFlowState.value) {
@@ -140,6 +140,7 @@ async function completeOAuthSignUp() {
 			state: oauthFlowState.value,
 			challenge: token.value,
 			sign_up_newsletter: subscribe.value,
+			account_consent: accountConsent,
 		})
 
 		await finishSignIn(res.session)
diff --git a/apps/frontend/src/pages/auth/sign-up.vue b/apps/frontend/src/pages/auth/sign-up.vue
index f1630f1033..42b7fbca9c 100644
--- a/apps/frontend/src/pages/auth/sign-up.vue
+++ b/apps/frontend/src/pages/auth/sign-up.vue
@@ -250,7 +250,7 @@ function isUsernameTakenValidationError(error: unknown): boolean {
 	return errorCode === 'username_taken'
 }
 
-async function createAccount() {
+async function createAccount(accountConsent: boolean) {
 	startLoading()
 	try {
 		const res = await client.labrinth.auth_v2.createAccount({
@@ -259,6 +259,7 @@ async function createAccount() {
 			email: email.value,
 			challenge: token.value,
 			sign_up_newsletter: subscribe.value,
+			account_consent: accountConsent,
 		})
 
 		await useAuth(res.session)
diff --git a/apps/labrinth/src/routes/internal/flows.rs b/apps/labrinth/src/routes/internal/flows.rs
index c81c66a32c..e7c8bef272 100644
--- a/apps/labrinth/src/routes/internal/flows.rs
+++ b/apps/labrinth/src/routes/internal/flows.rs
@@ -1438,6 +1438,19 @@ struct NewOAuthAccount {
     pub state: String,
     pub challenge: String,
     pub sign_up_newsletter: bool,
+    #[serde(default)]
+    pub account_consent: bool,
+}
+
+fn validate_account_consent(account_consent: bool) -> Result<(), ApiError> {
+    if account_consent {
+        info!("account consent trigger, denying");
+        return Err(ApiError::Request(eyre!(
+            "Sorry, something went wrong. Please try again"
+        )));
+    }
+
+    Ok(())
 }
 
 /// Create account with OAuth.  
@@ -1463,6 +1476,8 @@ pub async fn create_oauth_account(
         ApiError::InvalidInput(validation_errors_to_string(err, None))
     })?;
 
+    validate_account_consent(new_account.account_consent)?;
+
     if !check_hcaptcha(&req, &new_account.challenge).await? {
         return Err(ApiError::Turnstile);
     }
@@ -1709,6 +1724,8 @@ pub struct NewAccount {
     pub email: String,
     pub challenge: Option<String>,
     pub sign_up_newsletter: Option<bool>,
+    #[serde(default)]
+    pub account_consent: bool,
 }
 
 #[derive(Debug, Validate)]
@@ -1996,6 +2013,8 @@ pub async fn create_account_with_password(
 ) -> Result<HttpResponse, ApiError> {
     let new_account = new_account.into_inner();
 
+    validate_account_consent(new_account.account_consent)?;
+
     if !check_hcaptcha(&req, new_account.challenge.as_deref().unwrap_or(""))
         .await?
     {
diff --git a/packages/api-client/src/modules/labrinth/types.ts b/packages/api-client/src/modules/labrinth/types.ts
index cbe00e4f90..c3b813eb2a 100644
--- a/packages/api-client/src/modules/labrinth/types.ts
+++ b/packages/api-client/src/modules/labrinth/types.ts
@@ -756,6 +756,7 @@ export namespace Labrinth {
 				email: string
 				challenge: string
 				sign_up_newsletter?: boolean
+				account_consent?: boolean
 			}
 
 			export type CreateAccountResponse = {
@@ -773,6 +774,7 @@ export namespace Labrinth {
 				state: string
 				challenge: string
 				sign_up_newsletter: boolean
+				account_consent?: boolean
 			}
 
 			export type CreateOAuthAccountResponse = {