Skip to content

Add Turnstile protection to hosted login - #183

Merged
s3rot0n1n merged 4 commits into
mainfrom
feat/login-turnstile
Nov 3, 2026
Merged

s3rot0n1n merged 4 commits into
mainfrom
feat/login-turnstile

Conversation

@s3rot0n1n

Copy link
Copy Markdown
Contributor

Summary

  • Add optional Cloudflare Turnstile verification to hosted email sign-in and OAuth login pages.
  • Upgrade shared CodeLit packages to 0.8.0 and update the MCP conformance response shape.
  • Document Turnstile configuration and pass its keys through Docker Compose.

Testing

  • Added API tests for Turnstile configuration, login page rendering, and rejecting OTP requests without a token.
  • Added OAuth page tests for Turnstile widget rendering.
  • QA deploy smoke checks: API health returned 200, and hosted login rendered the Turnstile widget.
  • Full browser sign-in and token verification on QA: Not run.

Guard the email-OTP send on the hosted sign-in page with Turnstile when
TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY are both set. Bump
@codelitdev/* to 0.8.0 for the hosted-login captcha option and update the
conformance adapter to return structuredContent.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-02T18:04:11.899886Z 46c9971 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Rajat and others added 3 commits November 2, 2026 23:49
Keep main's removal of the OAuth team picker and layer the Turnstile
captcha on the hosted login router.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Account-wide OAuth (8fc33c3) dropped claimedTeamId from TestPrincipal and
getTeamMembership from AuthDependencies. Two tests still set them, which
fails the test typecheck in the Platform Conformance verify job.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Combine the Turnstile captcha with main's FrontLit login branding.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
@s3rot0n1n
s3rot0n1n merged commit a0d9451 into main Nov 3, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant