[thomasluizon]

When bot protection is enabled, /oauth/send-code now requires the same Turnstile verification as /api/auth/send-code before the email handler can cache a code or enqueue delivery. With protection disabled, email sign-in and resend continue without a token.

OAuthController.cs applies RequireBotProtection and appends the optional TurnstileToken request field. OAuthLoginPage.cs conditionally renders the widget and its loader using the public BotProtection:SiteKey setting added to BotProtectionSettings.cs and appsettings.json. The secret never enters the page. OAuthPageScript.cs sends the token, blocks submission until verification completes, and resets each consumed token for retries and resends. The shared widget remains available on the code step so resending also obtains fresh verification. SecurityHeadersMiddleware.cs allows Cloudflare's script and frame on OAuth pages while keeping same-origin connections and the embedding restriction.

Controller, page, middleware, and script unit tests cover the actual declared filter, the real send-code handler's cache and email queue effects, conditional rendering, token expiry, failures, resends, and disabled behavior. Existing command validation and domain behavior are reused. OpenAPI documents were regenerated by the build and have no diff.

Closes thomasluizon/orbit-tickets#1506

Assumptions

• The API needs its own public BotProtection:SiteKey configuration for this server-rendered page; rejected reading a frontend repository's build-time key because this ticket is scoped to the API.
• Keep one widget available across both email and code steps; rejected hiding it after the first send because resends require a fresh token too.
• Exercise the inline script with dependency-free Node unit tests alongside xUnit; rejected adding a JavaScript runtime package or browser tooling.

Test evidence

Before implementation, the unchanged tests passed with the defect present:

dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~OAuthControllerTests|FullyQualifiedName~OAuthLoginPageTests|FullyQualifiedName~RequireBotProtectionFilterTests'

Result: 106 passed. Existing direct controller tests did not exercise the missing route filter.

Added OAuthControllerTests.SendCode_DeclaredBotProtection_GatesEmailDelivery, which uses the route's declared filter and the real SendCodeCommandHandler with mocked infrastructure ports:

dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~SendCode_DeclaredBotProtection_GatesEmailDelivery'

Before the fix: three failed and one passed. Enabled requests with missing or rejected tokens returned 200 instead of 400; the valid-token case never called the verifier. The disabled case passed. After the fix, all four cases pass and assert cache writes and queued email jobs only for accepted requests.

The unchanged middleware tests also passed before the CSP fix:

dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter 'FullyQualifiedName~SecurityHeaders'
dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~InvokeAsync_OAuthPath_AllowsTurnstileScriptsAndFrames'

The first command passed 11 unchanged tests. After strengthening the OAuth CSP test and before changing middleware, the second command failed because the policy lacked the Cloudflare script origin. It passes after the fix.

Final verification, each with exit code 0:

dotnet build Orbit.slnx
dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter 'FullyQualifiedName~OAuthControllerTests|FullyQualifiedName~OAuthLoginPageTests|FullyQualifiedName~RequireBotProtectionFilterTests|FullyQualifiedName~SecurityHeadersMiddlewareTests'
node --test tests/Orbit.Infrastructure.Tests/Controllers/OAuthPageScriptTests.mjs
dotnet test tests/Orbit.Domain.Tests --no-build
dotnet test tests/Orbit.Application.Tests --no-build
dotnet test tests/Orbit.Infrastructure.Tests --no-build
dotnet test tests/Orbit.Analyzers.Tests --no-build

Build: 0 errors. Focused tests: 124 passed. Script tests: 11 passed. Full project suites: Domain 671, Application 5485, Infrastructure 3364, Analyzers 32 passed. Commit hooks passed formatting, dash, timeless, root allowlist, and suppression checks. No browser or running application was used, as required by the work order.

External interface evidence

Read the actual Cloudflare loader source, not just documentation, with:

curl -fsSL 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit' -o /tmp/orbit-1506-turnstile-api.js

The inspected response's SHA-256 was 18075576bfb9f1a312df482b69d71e05b2a749dbb2afaed4d1ef8e0026701690. The source exports render and reset, reads the onload query parameter, merges render options into the widget configuration, and reads sitekey, size, language, callback, expired-callback, timeout-callback, and error-callback. The render function returns the widget identifier used by reset. Its supported values include flexible and lowercase pt-br; the page converts its locale to lowercase. Script fixtures use those confirmed callback names and identifier semantics.

The required script and frame origins also follow Cloudflare's CSP guidance.

Manual steps

Activation remains the owner's separate action and is outside this ticket. Before enabling protection:

• In Cloudflare dashboard > Turnstile > the selected widget > Hostname management, allow api.useorbit.org. Confirm that the widget verifies successfully on the OAuth authorize page for that host.
• In Render dashboard > the Orbit API service serving api.useorbit.org > Environment, set BotProtection__SiteKey to that widget's public key and BotProtection__SecretKey to its paired secret, then set BotProtection__Enabled=true when ready to activate. After the configuration is deployed, confirm that /oauth/authorize loads the widget, a valid token permits /oauth/send-code, and a missing token receives 400 without an email job. The checked-in setting remains disabled.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the complete OAuth email-code protection change, including the existing verification filter, email-delivery handler, browser script, and sibling consumer contracts.

• Server-side enforcement: /oauth/send-code now verifies Turnstile before dispatching email delivery when protection is enabled, using an append-only optional request field.
• Authorize-page integration: Conditional widget loading exposes only the public site key; send and resend require fresh tokens, including after failed requests.
• Browser policy: OAuth CSP permits Cloudflare scripts and frames while retaining same-origin connections and the existing embedding restrictions.
• Verification: Independently passed 124 focused .NET tests and all 11 JavaScript tests. Live browser and deployed-widget validation were not performed; the PR documents hostname/key configuration and activation checks.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}