fix: protect public Auth flows from automated abuse (#1904)

* fix: add Turnstile to public auth flows

* test: isolate Turnstile auth tests

lib/auth/__tests__/turnstile.test.ts

@@ -0,0 +1,129 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { eventBus } from '@/lib/events/bus'
+import {
+  captchaTokenOptions,
+  getTurnstileRolloutState,
+  isTurnstileSubmissionBlocked,
+  resolveTurnstileSiteKey,
+} from '../turnstile'
+
+const readRepoFile = (file: string) =>
+  readFileSync(path.join(process.cwd(), file), 'utf8')
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  eventBus.clear()
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe('Turnstile rollout state', () => {
+  it('keeps Auth available while the public site key is absent', () => {
+    expect(resolveTurnstileSiteKey(undefined)).toBeNull()
+    expect(resolveTurnstileSiteKey('')).toBeNull()
+    expect(resolveTurnstileSiteKey('   ')).toBeNull()
+    expect(getTurnstileRolloutState(undefined)).toBe('disabled')
+    expect(isTurnstileSubmissionBlocked(null, undefined)).toBe(false)
+  })
+
+  it('treats an unsubstituted Docker sentinel as disabled', () => {
+    const sentinel = '__NEXT_PUBLIC_TURNSTILE_SITE_KEY__'
+    expect(resolveTurnstileSiteKey(sentinel)).toBeNull()
+    expect(getTurnstileRolloutState(sentinel)).toBe('disabled')
+    expect(isTurnstileSubmissionBlocked(null, sentinel)).toBe(false)
+  })
+
+  it('fails closed after the client site key is configured', () => {
+    const siteKey = '  public-site-key  '
+    expect(resolveTurnstileSiteKey(siteKey)).toBe('public-site-key')
+    expect(getTurnstileRolloutState(siteKey)).toBe('client-enabled')
+    expect(isTurnstileSubmissionBlocked(null, siteKey)).toBe(true)
+    expect(isTurnstileSubmissionBlocked('', siteKey)).toBe(true)
+    expect(isTurnstileSubmissionBlocked('verified-token', siteKey)).toBe(false)
+  })
+
+  it('reads the runtime-substituted environment value at call time', () => {
+    vi.stubEnv('NEXT_PUBLIC_TURNSTILE_SITE_KEY', '')
+    expect(getTurnstileRolloutState()).toBe('disabled')
+
+    vi.stubEnv('NEXT_PUBLIC_TURNSTILE_SITE_KEY', 'runtime-site-key')
+    expect(getTurnstileRolloutState()).toBe('client-enabled')
+  })
+
+  it('forwards only a non-empty token to Supabase Auth', () => {
+    expect(captchaTokenOptions(null)).toEqual({})
+    expect(captchaTokenOptions(undefined)).toEqual({})
+    expect(captchaTokenOptions('   ')).toEqual({})
+    expect(captchaTokenOptions('  token-value  ')).toEqual({
+      captchaToken: 'token-value',
+    })
+  })
+})
+
+describe('Turnstile integration contract', () => {
+  it('protects every public Supabase Auth flow in scope', () => {
+    const login = readRepoFile('app/(auth)/login/login-client.tsx')
+    const register = readRepoFile('app/(auth)/register/page.tsx')
+    const sandbox = readRepoFile('app/sandbox/page.tsx')
+
+    expect(login).toMatch(
+      /signInWithPassword\([\s\S]*?options: captchaTokenOptions\(passwordCaptchaToken\)/,
+    )
+    expect(login).toMatch(
+      /resetPasswordForEmail\([\s\S]*?captchaTokenOptions\(resetCaptchaToken\)/,
+    )
+    expect(login).toContain('action="accounted_login"')
+    expect(login).toContain('action="accounted_password_reset"')
+
+    expect(register).toMatch(
+      /signUp\([\s\S]*?captchaTokenOptions\(captchaToken\)/,
+    )
+    expect(register).toContain('action="accounted_signup"')
+
+    expect(sandbox).toMatch(
+      /signInAnonymously\([\s\S]*?captchaTokenOptions\(captchaToken\)/,
+    )
+    expect(sandbox).toContain('action="accounted_sandbox"')
+  })
+
+  it('keeps the public key, CSP, and Docker runtime contract in sync', () => {
+    const envExample = readRepoFile('.env.example')
+    const dockerEnvExample = readRepoFile('.env.docker.example')
+    const dockerfile = readRepoFile('Dockerfile')
+    const entrypoint = readRepoFile('docker-entrypoint.sh')
+    const nextConfig = readRepoFile('next.config.ts')
+
+    expect(envExample).toContain('NEXT_PUBLIC_TURNSTILE_SITE_KEY=')
+    expect(dockerEnvExample).toContain('NEXT_PUBLIC_TURNSTILE_SITE_KEY=')
+    expect(dockerfile).toContain(
+      'NEXT_PUBLIC_TURNSTILE_SITE_KEY=__NEXT_PUBLIC_TURNSTILE_SITE_KEY__',
+    )
+    expect(entrypoint).toContain('__NEXT_PUBLIC_TURNSTILE_SITE_KEY__')
+    expect(nextConfig).toContain('https://challenges.cloudflare.com')
+    expect(nextConfig).toMatch(/script-src[\s\S]*?turnstileOrigin/)
+    expect(nextConfig).toMatch(/frame-src[\s\S]*?turnstileOrigin/)
+    expect(envExample).not.toContain('TURNSTILE_SECRET_KEY')
+    expect(dockerEnvExample).not.toContain('TURNSTILE_SECRET_KEY')
+  })
+
+  it('ships matching Swedish and English challenge messages', () => {
+    const swedish = JSON.parse(readRepoFile('messages/sv.json')).auth
+    const english = JSON.parse(readRepoFile('messages/en.json')).auth
+    const keys = [
+      'turnstile_checking',
+      'turnstile_required',
+      'turnstile_error',
+    ]
+
+    for (const key of keys) {
+      expect(swedish[key]).toBeTypeOf('string')
+      expect(swedish[key]).not.toBe('')
+      expect(english[key]).toBeTypeOf('string')
+      expect(english[key]).not.toBe('')
+    }
+  })
+})

lib/auth/turnstile.ts

@@ -0,0 +1,51 @@
+/**
+ * Client-side Cloudflare Turnstile rollout state for Supabase Auth.
+ *
+ * The public site key is intentionally safe to ship to the browser. The
+ * matching secret stays in Supabase Auth and must never be added to this app.
+ * A generic Docker image contains the sentinel below until its entrypoint
+ * substitutes the operator's runtime value, so an unsubstituted sentinel must
+ * fail open as "disabled" rather than render a broken widget.
+ */
+
+export const TURNSTILE_SITE_KEY_ENV = 'NEXT_PUBLIC_TURNSTILE_SITE_KEY'
+
+const UNCONFIGURED_SITE_KEYS = new Set([
+  '',
+  '__NEXT_PUBLIC_TURNSTILE_SITE_KEY__',
+])
+
+export type TurnstileRolloutState = 'disabled' | 'client-enabled'
+
+export function resolveTurnstileSiteKey(
+  value: string | undefined = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY,
+): string | null {
+  const siteKey = value?.trim() ?? ''
+  return UNCONFIGURED_SITE_KEYS.has(siteKey) ? null : siteKey
+}
+
+export function getTurnstileRolloutState(
+  value: string | undefined = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY,
+): TurnstileRolloutState {
+  return resolveTurnstileSiteKey(value) ? 'client-enabled' : 'disabled'
+}
+
+export function captchaTokenOptions(
+  token: string | null | undefined,
+): { captchaToken?: string } {
+  const captchaToken = token?.trim()
+  return captchaToken ? { captchaToken } : {}
+}
+
+/**
+ * Missing CAPTCHA configuration is an intentional rollout state: existing
+ * Auth flows keep working until the public site key is deployed. Once a site
+ * key exists, every protected form fails closed until Turnstile supplies a
+ * token.
+ */
+export function isTurnstileSubmissionBlocked(
+  token: string | null | undefined,
+  siteKeyValue: string | undefined = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY,
+): boolean {
+  return resolveTurnstileSiteKey(siteKeyValue) !== null && !captchaTokenOptions(token).captchaToken
+}