1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
"""Registration CAPTCHA is enforced for every fresh account when configured.
The gate used to be skipped whenever the request carried an `auth_key` — which
every real client sends (the password split) — so it protected nobody and a bot
skipped it by including the field. It now runs on `captcha.enabled` alone; the
desktop client is Chromium and renders the same widget.
"""
import pytest
@pytest.fixture
def captcha_on(client, monkeypatch):
"""Turn on a fake captcha: any config with both keys is `enabled`, and
verification succeeds only for the token 'good-token'."""
from meshbay_hub.api.users import _cfg
monkeypatch.setattr(_cfg.captcha, "site_key", "test-site")
monkeypatch.setattr(_cfg.captcha, "secret_key", "test-secret")
async def fake_verify(secret, token, remote_ip=None, allowed_hosts=None,
allow_unattributed=False):
return token == "good-token"
monkeypatch.setattr("meshbay_hub.captcha.verify_captcha", fake_verify)
def _body(**over):
b = {"username": "newbie", "email": "newbie@t.com", "auth_key": "a" * 44}
b.update(over)
return b
@pytest.mark.asyncio
async def test_missing_captcha_rejected_even_with_auth_key(client, captcha_on):
r = await client.post("/v1/users/register", json=_body())
assert r.status_code == 400
assert r.json()["detail"] == "captcha_required"
@pytest.mark.asyncio
async def test_bad_captcha_rejected(client, captcha_on):
r = await client.post("/v1/users/register",
json=_body(captcha_token="wrong"))
assert r.status_code == 400
assert r.json()["detail"] == "captcha_failed"
@pytest.mark.asyncio
async def test_good_captcha_accepted(client, captcha_on):
r = await client.post("/v1/users/register",
json=_body(captcha_token="good-token"))
assert r.status_code == 201
@pytest.mark.asyncio
async def test_no_captcha_configured_still_registers(client):
# Default test config has no captcha keys — registration proceeds without one.
r = await client.post("/v1/users/register", json=_body())
assert r.status_code == 201
|