Method TestVerifyCaptchaValid

internal/api/middleware_test.go:53–135

()

}

func (ts *MiddlewareTestSuite) TestVerifyCaptchaValid() {
	ts.Config.Security.Captcha.Enabled = true
	ts.Config.Security.Captcha.Provider = "hcaptcha"
	ts.Config.Security.Captcha.Secret = "test-secret"

	// Configure mock to return success
	ts.CaptchaVerifier.Result = &security.VerificationResponse{Success: true}
	ts.CaptchaVerifier.Err = nil

	adminClaims := &AccessTokenClaims{
		Role: "supabase_admin",
	}
	adminJwt, err := jwt.NewWithClaims(jwt.SigningMethodHS256, adminClaims).SignedString([]byte(ts.Config.JWT.Secret))
	require.NoError(ts.T(), err)
	cases := []struct {
		desc          string
		adminJwt      string
		captcha_token string
		expectVerify  bool
	}{
		{
			"Valid captcha response",
			"",
			captchaResponse,
			true,
		},
		{
			"Ignore captcha if admin role is present",
			adminJwt,
			"",
			false,
		},
	}
	for _, c := range cases {
		// Reset mock state between cases
		ts.CaptchaVerifier.LastToken = ""
		ts.CaptchaVerifier.LastClientIP = ""

		var buffer bytes.Buffer
		require.NoError(ts.T(), json.NewEncoder(&buffer).Encode(map[string]interface{}{
			"email":    "test@example.com",
			"password": "secret",
			"gotrue_meta_security": map[string]interface{}{
				"captcha_token": c.captcha_token,
			},
		}))
		req := httptest.NewRequest(http.MethodPost, "http://localhost", &buffer)
		req.Header.Set("Content-Type", "application/json")
		if c.adminJwt != "" {
			req.Header.Set("Authorization", "Bearer "+c.adminJwt)
		}

		beforeCtx := context.Background()
		req = req.WithContext(beforeCtx)

		w := httptest.NewRecorder()

		afterCtx, err := ts.API.verifyCaptcha(w, req)