path: root/packages/meshbay-hub/tests/test_captcha_host_check.py

"""A solved captcha has to have been solved on one of our own pages.

reCAPTCHA normally does this itself: the widget reports the hostname of the
page it is rendered in, and Google compares it against the key's domain list.
That is the check the desktop client cannot pass. Its interface ships inside
the package and is served from `app://meshbay` — not a preference, Chromium
refuses a service worker on a custom scheme and the hub must never become the
document origin — so the hostname Google sees is not the hub's and never can
be. The widget renders "ERROR for site owner: Invalid domain for site key",
which no amount of client-side configuration reaches, because the decision is
made on Google's servers.

Turning the key's own origin check off moves the decision here. `siteverify`
then reports the hostname it *observed* — not one the caller asserts — so this
stays a real check: a bot that embeds the site key on a page of its own is
refused on the hostname it actually served from, which is the attack that
turning the check off would otherwise open.

`allowed_hosts` empty means "do not check", which is what a deployment that
left the origin check with Google wants. That is the default, so an existing
hub upgrades without its captcha changing behaviour.

The desktop client needed one more thing, found only by trying it. Its origin
is `app://meshbay`, and the guess was that Google would report the host part,
`meshbay`. It does not: a solve it cannot attribute to a domain comes back
with an **empty** hostname. `allow_unattributed_host` is what admits those,
and it is a named flag rather than an allowlist entry because a blank in a
TOML list is a typo far more often than an intention.
"""

import json

import pytest

from meshbay_hub.captcha import verify_captcha
from meshbay_hub.config import CaptchaConfig, load_config



class _Resp:
    def __init__(self, payload):
        self._payload = payload

    def raise_for_status(self):
        return None

    def json(self):
        return json.loads(json.dumps(self._payload))


class _Client:
    """Stands in for httpx.AsyncClient, and records what was sent."""

    sent: list[dict] = []

    def __init__(self, payload):
        self._payload = payload

    def __call__(self, *a, **kw):
        return self

    async def __aenter__(self):
        return self

    async def __aexit__(self, *exc):
        return False

    async def post(self, url, data=None):
        type(self).sent.append(dict(data or {}))
        return _Resp(self._payload)


@pytest.fixture
def google(monkeypatch):
    """`siteverify` answers whatever the test says it answers."""
    def _answer(**payload):
        _Client.sent = []
        monkeypatch.setattr("httpx.AsyncClient", _Client(payload))
    return _answer


@pytest.mark.asyncio
async def test_a_solve_from_an_expected_host_is_accepted(google):
    google(success=True, hostname="meshbay.org")
    assert await verify_captcha("s", "t", allowed_hosts=frozenset({"meshbay.org"}))


@pytest.mark.asyncio
async def test_an_unattributed_solve_is_refused_by_default(google):
    """What the desktop client actually produces, and what it costs.

    `app://meshbay` does not report `meshbay`. Google attributes the solve to
    no domain at all and the hostname comes back **empty** — measured live,
    after the first attempt to allowlist `meshbay` failed. Refusing by default
    is right: an answer with no hostname must not read as "any hostname".
    """
    google(success=True, hostname="")
    assert not await verify_captcha(
        "s", "t", allowed_hosts=frozenset({"meshbay.org", "localhost"}))


@pytest.mark.asyncio
async def test_the_flag_admits_it_and_the_allowlist_is_not_how(google):
    """The flag is the only way in, on purpose.

    An empty allowlist entry would be the obvious alternative and is a bad
    one: a blank in a TOML list is a typo far more often than an intention,
    and `load_config` drops blanks for exactly that reason. So this must not
    work by accident from an allowlist alone.
    """
    google(success=True, hostname="")
    allowed = frozenset({"meshbay.org", "localhost"})
    assert await verify_captcha("s", "t", allowed_hosts=allowed, allow_unattributed=True)
    assert not await verify_captcha("s", "t", allowed_hosts=allowed | {""})


@pytest.mark.asyncio
async def test_the_flag_does_not_open_the_allowlist(google):
    """It admits *unattributed* solves, not solves from somewhere else.

    A bot on its own web page still reports that page's hostname, which is
    still not ours, flag or no flag.
    """
    google(success=True, hostname="a-bot-farm.example")
    assert not await verify_captcha(
        "s", "t", allowed_hosts=frozenset({"meshbay.org"}), allow_unattributed=True)


@pytest.mark.asyncio
async def test_a_solve_from_somewhere_else_is_refused(google):
    """The attack that turning off the key's origin check would open: the site
    key is public, so a bot can render the widget on a page of its own."""
    google(success=True, hostname="a-bot-farm.example")
    assert not await verify_captcha(
        "s", "t", allowed_hosts=frozenset({"meshbay.org", "meshbay"}))


@pytest.mark.asyncio
async def test_an_absent_hostname_field_reads_like_an_empty_one(google):
    """`hostname` missing and `hostname: ""` are the same answer."""
    google(success=True)
    allowed = frozenset({"meshbay.org"})
    assert not await verify_captcha("s", "t", allowed_hosts=allowed)
    assert await verify_captcha("s", "t", allowed_hosts=allowed, allow_unattributed=True)


@pytest.mark.asyncio
async def test_no_allowed_hosts_means_google_is_still_the_one_checking(google):
    """The default, and what every hub that never touched this config does.

    The hostname is whatever it is and this does not look: the key's own origin
    check is on, so the answer would not have come back successful otherwise.
    """
    google(success=True, hostname="somewhere.example")
    assert await verify_captcha("s", "t")
    assert await verify_captcha("s", "t", allowed_hosts=None)


@pytest.mark.asyncio
async def test_a_failed_solve_is_refused_whatever_the_hostname(google):
    """Order matters: `success` first, and the host check never rescues a no."""
    google(success=False, hostname="meshbay.org", **{"error-codes": ["timeout-or-duplicate"]})
    assert not await verify_captcha(
        "s", "t", allowed_hosts=frozenset({"meshbay.org"}))


@pytest.mark.asyncio
async def test_the_remote_ip_still_rides_along(google):
    """Unchanged behaviour, pinned because the signature grew a parameter."""
    google(success=True, hostname="meshbay.org")
    await verify_captcha("s", "t", "203.0.113.7", frozenset({"meshbay.org"}))
    assert _Client.sent == [{"secret": "s", "response": "t", "remoteip": "203.0.113.7"}]


@pytest.mark.asyncio
async def test_a_transport_failure_is_a_refusal_not_an_exception(monkeypatch):
    """Unchanged, and worth keeping: a captcha that cannot be checked is not a
    captcha that passed."""
    class _Boom(_Client):
        async def post(self, url, data=None):
            raise RuntimeError("no route to host")

    monkeypatch.setattr("httpx.AsyncClient", _Boom({}))
    assert not await verify_captcha("s", "t", allowed_hosts=frozenset({"meshbay.org"}))


@pytest.mark.asyncio
async def test_the_flag_alone_checks_nothing_without_an_allowlist(google):
    """`allowed_hosts` empty still means "do not check", flag or no flag —
    the whole block is skipped and reCAPTCHA is doing the origin check."""
    google(success=True, hostname="somewhere.example")
    assert await verify_captcha("s", "t", allow_unattributed=False)
    assert await verify_captcha("s", "t", allow_unattributed=True)


def test_the_config_hands_over_a_set_or_nothing():
    """`host_check` is what the caller passes straight through, so "unset" has
    to arrive as None rather than an empty set that refuses everything."""
    assert CaptchaConfig().host_check is None
    assert CaptchaConfig(allowed_hosts=[]).host_check is None
    assert CaptchaConfig(allowed_hosts=["meshbay.org", "meshbay"]).host_check == frozenset(
        {"meshbay.org", "meshbay"})


def test_hub_toml_carries_the_allowed_hosts(tmp_path):
    """An operator who turns off the key's origin check sets this, and it is
    the only place they can: the value depends on the deployment."""
    cfg_file = tmp_path / "hub.toml"
    cfg_file.write_text(
        '[captcha]\n'
        'site_key = "6Lsite"\n'
        'secret_key = "6Lsecret"\n'
        'allowed_hosts = ["meshbay.org", " meshbay ", "", "localhost"]\n')

    cfg = load_config(cfg_file)

    assert cfg.captcha.enabled
    assert cfg.captcha.host_check == frozenset({"meshbay.org", "meshbay", "localhost"}), (
        "entries are stripped and blanks dropped — a stray space in a TOML "
        "list would otherwise refuse every solve from that host")


def test_a_hub_toml_without_the_key_checks_nothing(tmp_path):
    """The upgrade path. A hub that never heard of this setting keeps the
    behaviour it has, with reCAPTCHA doing the origin check."""
    cfg_file = tmp_path / "hub.toml"
    cfg_file.write_text('[captcha]\nsite_key = "6Lsite"\nsecret_key = "6Lsecret"\n')

    assert load_config(cfg_file).captcha.host_check is None


def test_the_unattributed_flag_comes_from_the_config(tmp_path, monkeypatch):
    cfg_file = tmp_path / "hub.toml"
    cfg_file.write_text(
        '[captcha]\nsite_key = "k"\nsecret_key = "s"\n'
        'allowed_hosts = ["meshbay.org"]\nallow_unattributed_host = true\n')
    assert load_config(cfg_file).captcha.allow_unattributed_host is True

    cfg_file.write_text('[captcha]\nsite_key = "k"\nsecret_key = "s"\n')
    assert load_config(cfg_file).captcha.allow_unattributed_host is False, (
        "the default has to stay off — it is the looser of the two")

    monkeypatch.setenv("MESHBAY_CAPTCHA_ALLOW_UNATTRIBUTED_HOST", "true")
    assert load_config(cfg_file).captcha.allow_unattributed_host is True


def test_the_environment_can_override_the_list(monkeypatch, tmp_path):
    """Same shape as MESHBAY_ADMIN_USERS, for a container that has no file."""
    monkeypatch.setenv("MESHBAY_CAPTCHA_ALLOWED_HOSTS", "meshbay.org, meshbay ,")

    cfg = load_config(tmp_path / "absent.toml")

    assert cfg.captcha.host_check == frozenset({"meshbay.org", "meshbay"})