mirror of
https://github.com/Significant-Gravitas/AutoGPT.git
synced 2026-02-11 23:35:25 -05:00
104928c614
This PR adds Cloudflare's Turnstile CAPTCHA to the login, signup, and password reset pages. it is setup to only show and work when behave as is set to CLOUD so it will not show for local hosted users. ### Changes 🏗️ #### Backend Changes - **[backend/server/v2/turnstile/routes.py](https://github.com/Significant-Gravitas/AutoGPT/compare/dev...bently/secrt-1169-implement-captcha-on-sign-up?expand=1#diff-2c5c2cb13346370fc48bdde8691a0d3bbfc030f7718288101b67b641c7948c10)**: Created API endpoint at `/api/turnstile/verify` to proxy verification requests to Cloudflare - **[backend/server/v2/turnstile/service.py](https://github.com/Significant-Gravitas/AutoGPT/compare/dev...bently/secrt-1169-implement-captcha-on-sign-up?expand=1#diff-296991fdc3ea821ae5a568ca96bb89789f2fc7dda7b62f59ef6bcadfaea16e56)**: Implements service to verify CAPTCHA tokens with Cloudflare using server-side secret key #### Frontend Changes - **[frontend/src/lib/turnstile.ts](https://github.com/Significant-Gravitas/AutoGPT/compare/dev...bently/secrt-1169-implement-captcha-on-sign-up?expand=1#diff-a698e2718e0f6b0afe1d0c7fda571a7bfcbec6aeacc963c2b3620cc683dc4448)**: Client-side function to call the backend verification endpoint - **[frontend/src/components/auth/Turnstile.tsx](https://github.com/Significant-Gravitas/AutoGPT/compare/dev...bently/secrt-1169-implement-captcha-on-sign-up?expand=1#diff-71a73d58d0ba5e46e5702f2f2599284e72a8fcf6c5d0b5c72e7358570d631aa7)**: Reusable Turnstile component that renders and manages the CAPTCHA widget - **[frontend/src/hooks/useTurnstile.ts](https://github.com/Significant-Gravitas/AutoGPT/compare/dev...bently/secrt-1169-implement-captcha-on-sign-up?expand=1#diff-4a6a9363243ab2a88dbfb498917f464896ada059617bd8b0fb51df532c73827d)**: Custom hook that manages Turnstile state and conditionally activates based on environment #### Auth Flow Integration - Modified server actions in `login`, `signup`, and `reset_password` to accept and verify Turnstile tokens - Updated auth page components to integrate the CAPTCHA widget with form submissions ### Configuration Changes - Added two new environment variables: - `NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_SITE_KEY`: Public site key for frontend - `CLOUDFLARE_TURNSTILE_SECRET_KEY`: Secret key for backend verification ### Test Plan 📋 - Ask Bently for the keys to test locally! - [x] Test login, signup and password reset with Turnstile enabled (BEHAVE_AS=CLOUD) - [x] Verify CAPTCHA appears and must be completed before form submission - [x] Verify error message appears if CAPTCHA is not completed - [x] Verify form submission works after completing CAPTCHA - [x] Test login, signup and password reset with Turnstile disabled (BEHAVE_AS=LOCAL) - [x] Verify CAPTCHA does not appear - [x] Verify form submission works without CAPTCHA - [x] Test with invalid site key to ensure proper error handling --------- Co-authored-by: Krzysztof Czerwinski <34861343+kcze@users.noreply.github.com>