summercms/modules/bouncer/turnstile_test.go

package bouncer

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"io"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"net/url"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"
)

const turnstileTestSecret = "0x4AAAAAAA-test-secret-value"

// siteverify is an httptest fake of Cloudflare's siteverify endpoint. It
// records every form it receives and answers with the configured status and
// body.
type siteverify struct {
	srv    *httptest.Server
	calls  atomic.Int32
	mu     sync.Mutex
	forms  []url.Values
	status int
	body   string
	delay  time.Duration
}

func newSiteverify(t *testing.T, status int, body string) *siteverify {
	t.Helper()
	f := &siteverify{status: status, body: body}
	f.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		f.calls.Add(1)
		_ = r.ParseForm()
		f.mu.Lock()
		f.forms = append(f.forms, r.PostForm)
		f.mu.Unlock()
		if f.delay > 0 {
			select {
			case <-time.After(f.delay):
			case <-r.Context().Done():
				return
			}
		}
		w.WriteHeader(f.status)
		_, _ = io.WriteString(w, f.body)
	}))
	t.Cleanup(f.srv.Close)
	return f
}

func (f *siteverify) verifier(secret string, production bool) *Turnstile {
	return &Turnstile{Secret: secret, Production: production, Endpoint: f.srv.URL, Client: f.srv.Client()}
}

func (f *siteverify) lastForm(t *testing.T) url.Values {
	t.Helper()
	f.mu.Lock()
	defer f.mu.Unlock()
	if len(f.forms) == 0 {
		t.Fatal("siteverify was not called")
	}
	return f.forms[len(f.forms)-1]
}

func TestTurnstileVerifyMatrix(t *testing.T) {
	const ok = `{"success":true}`
	for _, tc := range []struct {
		name       string
		secret     string
		production bool
		failClosed bool
		token      string
		status     int
		body       string
		want       TurnstileVerdict
		wantCall   bool
		wantErr    bool
	}{
		{"open, no secret, development", "", false, false, "tok", 200, ok, TurnstilePassed, false, false},
		{"open, no secret, production", "", true, false, "tok", 200, ok, TurnstilePassed, false, false},
		{"closed, no secret, development", "", false, true, "tok", 200, ok, TurnstilePassed, false, false},
		{"closed, no secret, production", "", true, true, "tok", 200, ok, TurnstileUnavailable, false, false},
		{"closed, blank secret, production", "  ", true, true, "tok", 200, ok, TurnstileUnavailable, false, false},
		{"open, empty token", turnstileTestSecret, true, false, "", 200, ok, TurnstileFailed, false, false},
		{"closed, empty token", turnstileTestSecret, true, true, "", 200, ok, TurnstileFailed, false, false},
		{"open, token over the limit", turnstileTestSecret, false, false, strings.Repeat("a", TurnstileMaxTokenLength+1), 200, ok, TurnstileFailed, false, false},
		{"closed, token at the limit", turnstileTestSecret, false, true, strings.Repeat("a", TurnstileMaxTokenLength), 200, ok, TurnstilePassed, true, false},
		{"open, success true", turnstileTestSecret, false, false, "tok", 200, ok, TurnstilePassed, true, false},
		{"closed, success true", turnstileTestSecret, true, true, "tok", 200, ok, TurnstilePassed, true, false},
		{"open, success false", turnstileTestSecret, false, false, "tok", 200, `{"success":false,"error-codes":["invalid-input-response"]}`, TurnstileFailed, true, true},
		{"closed, success false", turnstileTestSecret, true, true, "tok", 200, `{"success":false}`, TurnstileFailed, true, true},
		{"open, non-2xx", turnstileTestSecret, false, false, "tok", 500, ok, TurnstileFailed, true, true},
		{"closed, non-2xx", turnstileTestSecret, true, true, "tok", 403, ok, TurnstileFailed, true, true},
		{"open, invalid JSON", turnstileTestSecret, false, false, "tok", 200, `<html>`, TurnstileFailed, true, true},
		{"closed, JSON without success", turnstileTestSecret, true, true, "tok", 200, `{"hostname":"x"}`, TurnstileFailed, true, true},
	} {
		t.Run(tc.name, func(t *testing.T) {
			f := newSiteverify(t, tc.status, tc.body)
			got, err := f.verifier(tc.secret, tc.production).Verify(t.Context(), tc.token, "203.0.113.7", tc.failClosed)
			if got != tc.want {
				t.Fatalf("verdict = %s, want %s (err %v)", got, tc.want, err)
			}
			if called := f.calls.Load() > 0; called != tc.wantCall {
				t.Fatalf("siteverify called = %t, want %t", called, tc.wantCall)
			}
			if (err != nil) != tc.wantErr {
				t.Fatalf("err = %v, want error %t", err, tc.wantErr)
			}
		})
	}

	// A nil verifier behaves like an unconfigured one in production.
	var nilT *Turnstile
	if v, _ := nilT.Verify(t.Context(), "tok", "", true); v != TurnstileUnavailable {
		t.Fatalf("nil closed = %s", v)
	}
	if v, _ := nilT.Verify(t.Context(), "tok", "", false); v != TurnstilePassed {
		t.Fatalf("nil open = %s", v)
	}
	if TurnstilePassed.String() != "passed" || TurnstileFailed.String() != "failed" || TurnstileUnavailable.String() != "unavailable" {
		t.Fatal("verdict names changed")
	}
}

func TestTurnstileVerifyTimeout(t *testing.T) {
	f := newSiteverify(t, 200, `{"success":true}`)
	f.delay = 2 * time.Second
	ctx, cancel := context.WithTimeout(t.Context(), 50*time.Millisecond)
	defer cancel()
	start := time.Now()
	got, err := f.verifier(turnstileTestSecret, true).Verify(ctx, "tok", "", false)
	if got != TurnstileFailed {
		t.Fatalf("verdict = %s", got)
	}
	if err == nil || !strings.Contains(err.Error(), "timeout") {
		t.Fatalf("err = %v, want a timeout", err)
	}
	if elapsed := time.Since(start); elapsed > time.Second {
		t.Fatalf("Verify took %s past a 50 ms deadline", elapsed)
	}
}

func TestTurnstileFormFields(t *testing.T) {
	f := newSiteverify(t, 200, `{"success":true}`)
	v := f.verifier(turnstileTestSecret, false)
	if got, err := v.Verify(t.Context(), "the-token", "198.51.100.4", false); got != TurnstilePassed || err != nil {
		t.Fatalf("verdict %s err %v", got, err)
	}
	form := f.lastForm(t)
	if form.Get("secret") != turnstileTestSecret || form.Get("response") != "the-token" || form.Get("remoteip") != "198.51.100.4" {
		t.Fatalf("form = %v", form)
	}

	if _, err := v.Verify(t.Context(), "the-token", "", false); err != nil {
		t.Fatal(err)
	}
	form = f.lastForm(t)
	if _, ok := form["remoteip"]; ok {
		t.Fatalf("remoteip sent for an empty ip: %v", form)
	}
	if form.Get("response") != "the-token" {
		t.Fatalf("form = %v", form)
	}
}

func passHandler(called *bool) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		*called = true
		w.WriteHeader(http.StatusNoContent)
	})
}

func TestTurnstileMiddlewareTokenSources(t *testing.T) {
	for _, tc := range []struct {
		name  string
		build func() *http.Request
	}{
		{"query", func() *http.Request {
			return httptest.NewRequest(http.MethodPost, "/register?turnstile_token=src-token", strings.NewReader(`{"turnstile_token":"other"}`))
		}},
		{"json body", func() *http.Request {
			r := httptest.NewRequest(http.MethodPost, "/register", strings.NewReader(`{"email":"a@b.c","turnstile_token":"src-token"}`))
			r.Header.Set("Content-Type", "application/json; charset=utf-8")
			return r
		}},
		{"json body without content type", func() *http.Request {
			return httptest.NewRequest(http.MethodPost, "/register", strings.NewReader(` {"turnstile_token":"src-token"}`))
		}},
		{"vendor json body", func() *http.Request {
			r := httptest.NewRequest(http.MethodPost, "/register", strings.NewReader(`{"turnstile_token":"src-token"}`))
			r.Header.Set("Content-Type", "application/vnd.api+json")
			return r
		}},
		{"urlencoded form", func() *http.Request {
			r := httptest.NewRequest(http.MethodPost, "/register", strings.NewReader(`email=a%40b.c&turnstile_token=src-token`))
			r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
			return r
		}},
	} {
		t.Run(tc.name, func(t *testing.T) {
			f := newSiteverify(t, 200, `{"success":true}`)
			called := false
			h := f.verifier(turnstileTestSecret, true).Middleware(true, "", nil, nil)(passHandler(&called))
			rec := httptest.NewRecorder()
			h.ServeHTTP(rec, tc.build())
			if rec.Code != http.StatusNoContent || !called {
				t.Fatalf("status %d called %t body %s", rec.Code, called, rec.Body)
			}
			if got := f.lastForm(t).Get("response"); got != "src-token" {
				t.Fatalf("token sent = %q", got)
			}
		})
	}

	// A custom field name is honoured; the default field is then ignored.
	f := newSiteverify(t, 200, `{"success":true}`)
	called := false
	h := f.verifier(turnstileTestSecret, true).Middleware(true, "cf_token", nil, nil)(passHandler(&called))
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/x?turnstile_token=wrong&cf_token=right", nil))
	if !called || f.lastForm(t).Get("response") != "right" {
		t.Fatalf("custom field: called %t form %v", called, f.lastForm(t))
	}
}

func TestTurnstileMiddlewareRestoresBody(t *testing.T) {
	for _, tc := range []struct {
		name, contentType, body string
	}{
		{"json", "application/json", `{"turnstile_token":"tok","name":"Ann"}`},
		{"form", "application/x-www-form-urlencoded", `turnstile_token=tok&name=Ann`},
		{"other media type", "text/plain", `turnstile_token=tok`},
	} {
		t.Run(tc.name, func(t *testing.T) {
			f := newSiteverify(t, 200, `{"success":true}`)
			var seen []byte
			next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				seen, _ = io.ReadAll(r.Body)
				w.WriteHeader(http.StatusOK)
			})
			// Open mode without a secret passes even when no token is found,
			// so the restored body is checked for every media type.
			v := f.verifier(turnstileTestSecret, false)
			if tc.contentType == "text/plain" {
				v = f.verifier("", false)
			}
			r := httptest.NewRequest(http.MethodPost, "/submit", strings.NewReader(tc.body))
			r.Header.Set("Content-Type", tc.contentType)
			rec := httptest.NewRecorder()
			v.Middleware(false, "", nil, nil)(next).ServeHTTP(rec, r)
			if rec.Code != http.StatusOK {
				t.Fatalf("status %d", rec.Code)
			}
			if string(seen) != tc.body {
				t.Fatalf("handler read %q, want %q", seen, tc.body)
			}
		})
	}
}

// turnstileCall records what a TurnstileWriter received.
type turnstileCall struct {
	status  int
	verdict TurnstileVerdict
}

func TestTurnstileMiddlewareStatuses(t *testing.T) {
	f := newSiteverify(t, 200, `{"success":true}`)
	for _, tc := range []struct {
		name       string
		v          *Turnstile
		failClosed bool
		target     string
		want       int
		verdict    TurnstileVerdict
		code       string
	}{
		{"unavailable", f.verifier("", true), true, "/x?turnstile_token=t", 503, TurnstileUnavailable, "turnstile_unavailable"},
		{"failed without token", f.verifier(turnstileTestSecret, true), true, "/x", 422, TurnstileFailed, "turnstile_failed"},
		{"passed", f.verifier(turnstileTestSecret, true), false, "/x?turnstile_token=t", 204, TurnstilePassed, ""},
	} {
		t.Run(tc.name+" default writer", func(t *testing.T) {
			called := false
			rec := httptest.NewRecorder()
			tc.v.Middleware(tc.failClosed, "", nil, nil)(passHandler(&called)).ServeHTTP(rec, httptest.NewRequest(http.MethodPost, tc.target, nil))
			if rec.Code != tc.want || called != (tc.want == 204) {
				t.Fatalf("status %d called %t", rec.Code, called)
			}
			if tc.code != "" {
				if rec.Header().Get("Content-Type") != "application/json" {
					t.Fatalf("content type %q", rec.Header().Get("Content-Type"))
				}
				var body map[string]string
				if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil || body["error"] != tc.code || len(body) != 1 {
					t.Fatalf("body %s", rec.Body)
				}
			}
		})
		t.Run(tc.name+" app writer", func(t *testing.T) {
			var calls []turnstileCall
			write := func(w http.ResponseWriter, _ *http.Request, status int, verdict TurnstileVerdict) {
				calls = append(calls, turnstileCall{status, verdict})
				w.WriteHeader(status)
			}
			called := false
			rec := httptest.NewRecorder()
			tc.v.Middleware(tc.failClosed, "", nil, write)(passHandler(&called)).ServeHTTP(rec, httptest.NewRequest(http.MethodPost, tc.target, nil))
			if tc.want == 204 {
				if len(calls) != 0 || !called {
					t.Fatalf("writer calls %v called %t", calls, called)
				}
				return
			}
			if len(calls) != 1 || calls[0].status != tc.want || calls[0].verdict != tc.verdict || called {
				t.Fatalf("writer calls %v called %t", calls, called)
			}
		})
	}

	// A body over the router's limit answers 413 without calling siteverify.
	before := f.calls.Load()
	called := false
	h := f.verifier(turnstileTestSecret, true).Middleware(true, "", nil, nil)(passHandler(&called))
	rec := httptest.NewRecorder()
	r := httptest.NewRequest(http.MethodPost, "/x", strings.NewReader(strings.Repeat("a", 64)))
	r.Header.Set("Content-Type", "application/json")
	r.Body = http.MaxBytesReader(rec, r.Body, 8)
	h.ServeHTTP(rec, r)
	if rec.Code != http.StatusRequestEntityTooLarge || called || f.calls.Load() != before {
		t.Fatalf("over-limit body: status %d called %t", rec.Code, called)
	}

	// The client IP func supplies remoteip.
	h = f.verifier(turnstileTestSecret, true).Middleware(true, "", func(*http.Request) string { return "192.0.2.9" }, nil)(passHandler(&called))
	h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/x?turnstile_token=t", nil))
	if got := f.lastForm(t).Get("remoteip"); got != "192.0.2.9" {
		t.Fatalf("remoteip = %q", got)
	}
}

func TestTurnstileNeverLogsSecret(t *testing.T) {
	var logs bytes.Buffer
	prev := slog.Default()
	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, &slog.HandlerOptions{Level: slog.LevelDebug})))
	defer slog.SetDefault(prev)

	const token = "client-token-must-not-be-logged"
	// A transport error: the endpoint refuses connections.
	dead := httptest.NewServer(http.NotFoundHandler())
	endpoint := dead.URL + "/siteverify?secret=" + turnstileTestSecret
	dead.Close()
	v := &Turnstile{Secret: turnstileTestSecret, Endpoint: endpoint, Client: &http.Client{Timeout: time.Second}}
	called := false
	rec := httptest.NewRecorder()
	v.Middleware(false, "", nil, nil)(passHandler(&called)).ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/x?turnstile_token="+token, nil))
	if rec.Code != http.StatusUnprocessableEntity || called {
		t.Fatalf("transport error: status %d called %t", rec.Code, called)
	}

	// A refusal (success false) is logged at debug with the codes only.
	f := newSiteverify(t, 200, `{"success":false,"error-codes":["invalid-input-response","`+turnstileTestSecret+`"]}`)
	rec = httptest.NewRecorder()
	f.verifier(turnstileTestSecret, false).Middleware(false, "", nil, nil)(passHandler(&called)).ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/x?turnstile_token="+token, nil))
	if rec.Code != http.StatusUnprocessableEntity {
		t.Fatalf("refusal: status %d", rec.Code)
	}

	out := logs.String()
	if !strings.Contains(out, "turnstile verification failed") || !strings.Contains(out, "turnstile token refused") {
		t.Fatalf("expected both log lines, got:\n%s", out)
	}
	if strings.Contains(out, turnstileTestSecret) || strings.Contains(out, token) {
		t.Fatalf("log leaks the secret or the token:\n%s", out)
	}

	// The returned error never carries them either.
	_, err := v.Verify(t.Context(), token, "", false)
	if err == nil || strings.Contains(err.Error(), turnstileTestSecret) || strings.Contains(err.Error(), token) || strings.Contains(err.Error(), "siteverify?") {
		t.Fatalf("err = %v", err)
	}
	if errors.Is(err, errTurnstileRefused) {
		t.Fatal("a transport error is not a refusal")
	}
}