feat(e2e): exercise the turnstile challenge flow end to end - #77
Closed
fionera wants to merge 4 commits into
Closed
Conversation
Adds three new validation types alongside none and pow, backed by one shared captcha validator. The challenge GET serves a static per-level body carrying the sitekey; the POST exchanges the widget response token for a cookie after verifying it against the provider siteverify endpoint (fail closed) and binding the reported hostname to the request identity, accepting subdomains since trusted_domains may collapse the identity host to a suffix. The web protocol type numbering skips t:2, which the challenge page capability checks already reserve for a worker-based POW. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Provider test keys report a fixed hostname unrelated to the page, so tests cannot pass the hostname binding. Adds an explicit opt-out for captcha levels, documented as test-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Splits the example SPOE config into separate validate and challenge agents: captcha verification does a network round-trip to the provider, so the challenge group needs a 6s processing timeout while the per-request validate path stays at 100ms. The e2e stack gains a second frontend backed by a turnstile level using Cloudflare's always-passing dummy keys, driven by the same browser flow as the POW test. Documents captcha configuration in the README and the visitor help page, including the third-party script exception. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Member
Author
|
Consolidated into #78 — the three-way split created hard sequential dependencies and CI didn't trigger on stacked bases. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Last of the three captcha PRs (server #75 → web #76 → integration). Stacked on #76 and additionally merges #75's branch, since the e2e needs both the Go validator and the browser widget — the diff shown here includes #75's commits until it merges; the new work is the last commit.
examples/haproxy/berghain.cfg): thevalidateandchallengegroups now run as separate agents —berghainkeepstimeout processing 100msfor the hot per-request path, the newberghain_challengeagent gets6sbecause captcha verification does an HTTPS round-trip to the provider.haproxy.cfg(example + e2e) references the new engine for the challenge backend.:18081) backed by aturnstilelevel using Cloudflare's official always-passing dummy keys, driven by the same chromedp flow as the existing POW test (challenge page → widget auto-solves → token verified against the real Turnstile siteverify → cookie → backend reached). Dummy keys report a fixedhostname: example.com, henceskip_hostname_check: truein the test config (flag added in feat: add turnstile, hcaptcha, and recaptcha challenge types #75).Test plan
./test/e2e/run.shlocally (HAProxy 3.4): both tests pass —TestBrowserSolvesChallenge(POW, 3.6s) andTestBrowserSolvesTurnstileChallenge(6.0s) against the real Turnstile endpoints.haproxy -c -f examples/haproxy/haproxy.cfgvalidates.go test ./..., web lint/test/build all green on the merged branch.🤖 Generated with Claude Code