Feat | Migrate from Google reCAPTCHA to Cloudflare Turnstile (#121)

* feat: Migrate from Google reCAPTCHA to Cloudflare Turnstile

* chore: Change to vendor recommended implementation

* feat: Update login attempts retrieval to use user data if available

* chore: Add PR's requested changes and Unit tests

- Validation failure when cf-turnstile-response is missing
- Login flow behaviour before/after CAPTCHA threshold
- Rendering of Turnstile on the thresholded login screen
- Auth form submission when Turnstile is expired or not solved

* chore: upgrade to Node 22.22.2 and fix yarn build (#131)

- Bump NODE_VERSION 20.20.2 → 22.22.2 in Dockerfile and .nvmrc
- Replace node-sass@8 (EOL, no Node 22 binary) with sass@^1.77 (dart-sass)
- Bump webpack@^5.94, webpack-cli@^5.1.4 (resolves OpenSSL-3 legacy hash issue)
- Bump copy-webpack-plugin@^11 for webpack 5.94+ compatibility
- Add util:false to webpack.common.js resolve.fallback (webpack 5.106 is
  stricter than 5.70 about unresolved Node built-ins; jsdom/tough-cookie
  transitively require util which should not be browser-polyfilled)
- Drop unused devDeps: clean-webpack-plugin, html-webpack-plugin,
  optimize-css-assets-webpack-plugin, path polyfill, webpack-node-externals
- Regenerate yarn.lock

* chore: Add PR's requested changes

* chore: Add PR's requested changes

* chore: Fix composer.lock update issue

* feat: Add remote IP address to Turnstile verification request

* fix: add timeout and scope retry to connection errors in TurnstileClient

- Add ->timeout(5) to bound max wall time to ~15s during Cloudflare outages
- Restrict retry to ConnectionException only so success:false responses
  (valid HTTP 200) do not trigger wasteful retries

---------

Co-authored-by: sebastian marcet <smarcet@gmail.com>

Author: matiasperrone-exo

.env.example

@@ -58,8 +58,8 @@ LOG_LEVEL=info
 
 EVENTBRITE_OAUTH2_PERSONAL_TOKEN=
 
-RECAPTCHA_PUBLIC_KEY=
-RECAPTCHA_PRIVATE_KEY=
+TURNSTILE_SECRET_KEY=
+TURNSTILE_SITE_KEY=
 
 BANNING_ENABLE=
 SUPPORT_EMAIL=

.github/workflows/pull_request_unit_tests.yml

@@ -65,6 +65,9 @@ jobs:
         env:
           COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.PAT }}"} }'
       - name: 'Run Tests'
+        env:
+          TEST_USER_EMAIL: ${{ secrets.TEST_USER_EMAIL }}
+          TEST_USER_PASSWORD: ${{ secrets.TEST_USER_PASSWORD }}
         run: |
           ./update_doctrine.sh
           php artisan doctrine:migrations:migrate --no-interaction

.github/workflows/push.yml

@@ -61,6 +61,9 @@ jobs:
          env:
            COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.PAT }}"} }'
        - name: 'Run Tests'
+         env:
+           TEST_USER_EMAIL: ${{ secrets.TEST_USER_EMAIL }}
+           TEST_USER_PASSWORD: ${{ secrets.TEST_USER_PASSWORD }}
          run: |
            ./update_doctrine.sh
            php artisan doctrine:migrations:migrate --no-interaction

.nvmrc

@@ -1 +1 @@
-18.20.2
+22.22.2

Dockerfile

@@ -2,7 +2,7 @@ FROM php:8.3-fpm
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG NVM_VERSION="v0.40.3"
-ENV NODE_VERSION="18.20.4"
+ENV NODE_VERSION="22.22.2"
 ARG YARN_VERSION="1.22.22"
 ARG GITHUB_OAUTH_TOKEN
 ARG XDEBUG_VERSION="xdebug-3.3.2"

app/Http/Controllers/Auth/EmailVerificationController.php

@@ -13,6 +13,7 @@
  **/
 use App\Http\Controllers\Controller;
 use App\libs\Utils\EmailUtils;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Services\Auth\IUserService;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Redirect;
@@ -87,7 +88,7 @@ protected function validator(array $data)
     {
         return Validator::make($data, [
             'email'                    => 'required|string|email|max:255',
-            'g-recaptcha-response'     => 'required|recaptcha',
+            'cf-turnstile-response'    => ['required', new Turnstile()],
         ]);
     }
 
@@ -100,7 +101,6 @@ public function resend(LaravelRequest $request)
             if (!$validator->passes()) {
                 return Redirect::action('Auth\EmailVerificationController@showVerificationForm')->withErrors($validator);
             }
-
             $user = $this->user_service->resendVerificationEmail($payload);
 
             return view("auth.email_verification_resend_success", ['user' => $user]);

app/Http/Controllers/Auth/ForgotPasswordController.php

@@ -13,6 +13,7 @@
  **/
 
 use App\Http\Controllers\Controller;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\libs\Utils\EmailUtils;
 use App\Services\Auth\IUserService;
 use Illuminate\Support\Facades\Log;
@@ -162,6 +163,7 @@ protected function validator(array $data)
     {
         return Validator::make($data, [
             'email' => 'required|string|email|max:255',
+            'cf-turnstile-response' => ['required', new Turnstile()],
         ]);
     }
 

app/Http/Controllers/Auth/PasswordSetController.php

@@ -13,6 +13,7 @@
  **/
 
 use App\Http\Controllers\Controller;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Http\Utils\CountryList;
 use App\libs\Auth\Repositories\IUserRegistrationRequestRepository;
 use App\Services\Auth\IUserService;
@@ -155,7 +156,7 @@ protected function validator(array $data)
             'company' => 'sometimes|string|max:100',
             'country_iso_code' => 'required|string|country_iso_alpha2_code',
             'password' => 'required|string|confirmed|password_policy',
-            'g-recaptcha-response' => 'required|recaptcha',
+            'cf-turnstile-response' => ['required', new Turnstile()],
         ]);
     }
 

app/Http/Controllers/Auth/RegisterController.php

@@ -13,6 +13,7 @@
  **/
 use App\Http\Controllers\Controller;
 use App\Http\Utils\CountryList;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Services\Auth\IUserService;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Config;
@@ -177,7 +178,7 @@ protected function validator(array $data)
             'country_iso_code'         => 'required|string|country_iso_alpha2_code',
             'email'                    => 'required|string|email|max:255',
             'password'                 => 'required|string|confirmed|password_policy',
-            'g-recaptcha-response'     => 'required|recaptcha',
+            'cf-turnstile-response'    => ['required', new Turnstile()],
         ];
 
         if(!empty(Config::get("app.code_of_conduct_link", null))){

app/Http/Controllers/Auth/ResetPasswordController.php

@@ -13,6 +13,7 @@
  **/
 use App\Http\Controllers\Controller;
 use App\libs\Auth\Repositories\IUserPasswordResetRequestRepository;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Services\Auth\IUserService;
 use Auth\Exceptions\UserPasswordResetRequestVoidException;
 use Illuminate\Support\Facades\Log;
@@ -113,7 +114,7 @@ protected function validator(array $data)
         return Validator::make($data, [
             'token'                    => 'required',
             'password'                 => 'required|string|confirmed|password_policy',
-            'g-recaptcha-response'     => 'required|recaptcha',
+            'cf-turnstile-response'    => ['required', new Turnstile()],
         ]);
     }