feat: protect auth with Turnstile

2026-07-30 23:08:36 +02:00
parent 6382e83e28
commit 9cd2e5c2e3
7 changed files with 127 additions and 7 deletions
@@ -724,6 +724,24 @@ public sealed class AuthAndSystemControllerTests
        summarizer.Verify(x => x.RunProbeAsync(It.IsAny<CancellationToken>()), Times.Once);
    }

+    [Fact]
+    public async Task Login_rejects_missing_turnstile_token_when_configured()
+    {
+        var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
+        {
+            ["Turnstile:SiteKey"] = "site-key",
+            ["Turnstile:SecretKey"] = "secret-key",
+        }).Build();
+        var users = CreateUserManager();
+        var controller = new AuthController(config, users.Object, Mock.Of<ITokenService>(), Mock.Of<IAppEmailSender>(), Mock.Of<IGoogleTokenValidator>(), Mock.Of<IMicrosoftTokenValidator>(), NullLogger<AuthController>.Instance, Mock.Of<ITwoFactorPendingTokenService>(), TestHostFactory.CreateInMemoryDb(), httpClients: Mock.Of<IHttpClientFactory>());
+
+        var result = await controller.Login(new AuthController.LoginRequest("person@example.com", "password"), CancellationToken.None);
+
+        var badRequest = Assert.IsType<BadRequestObjectResult>(result);
+        Assert.Equal("Security verification failed. Please try again.", badRequest.Value);
+        users.Verify(x => x.FindByEmailAsync(It.IsAny<string>()), Times.Never);
+    }
+
    private static IConfiguration BuildConfig()
    {
        return new ConfigurationBuilder()