captcha and honeypot on signup

src/routes/signup/+page.server.ts

@@ -1,6 +1,11 @@
 import { fail, redirect } from '@sveltejs/kit';
 import { createSession, createUser, findUser } from '$lib/server/auth';
-import type { Actions } from './$types';
+import { createCaptcha, verifyCaptcha } from '$lib/server/captcha';
+import type { Actions, PageServerLoad } from './$types';
+
+export const load: PageServerLoad = () => {
+	return { captcha: createCaptcha() };
+};
 
 export const actions: Actions = {
 	default: async ({ request, cookies }) => {
@@ -8,6 +13,14 @@ export const actions: Actions = {
 		const username = String(form.get('username') ?? '').trim();
 		const password = String(form.get('password') ?? '');
 
+		// honeypot: real browsers leave this hidden field empty
+		if (String(form.get('website') ?? '') !== '') {
+			return fail(400, { username, error: 'Signup rejected.' });
+		}
+		if (!verifyCaptcha(String(form.get('token') ?? ''), String(form.get('captcha') ?? ''))) {
+			return fail(400, { username, error: 'The characters did not match - try the new image.' });
+		}
+
 		if (!/^[a-zA-Z0-9_.-]{3,30}$/.test(username)) {
 			return fail(400, {
 				username,