release: develop to main — Turnstile captchaToken fix for signup gate - #220
Conversation
…tadata check signInWithIdToken does not accept a top-level data/raw_user_meta_data payload; auth-js ignores it. Send the token as options.captchaToken (gotrue_meta_security.captcha_token) so GoTrue can verify it when Auth CAPTCHA protection is enabled. Remove the impossible raw_user_meta_data.cf_turnstile_response check from before-signup; IP bans and signup rate limits remain.
fix: pass Turnstile via captchaToken and stop broken before-signup metadata check
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
1 participant
Contribution workflow
main: This PR targetsmainfor production release.Description
Release
developto production. This batch contains the follow-up fix for the Cloudflare Turnstile signup gate: the Turnstile token must be passed viaoptions.captchaToken(GoTruegotrue_meta_security.captcha_token), not adatapayload that auth-js ignores.Type of Change
Related Issues
Merges PR #219 from develop.
Changes Made
signInWithGoogleIdToken: send the Turnstile token asoptions: { captchaToken }— verified against auth-js 2.108.2SignInWithIdTokenCredentials.before-signup: remove the impossibleraw_user_meta_data.cf_turnstile_responsecheck; GoTrue verifies CAPTCHA when Auth → CAPTCHA protection is enabled. IP bans + signup rate limits remain..env.example: point the Turnstile secret at Supabase Auth CAPTCHA settings (not an edge-function-only path).authServiceunit tests updated to thecaptchaTokenshape.Testing
Code Quality
pnpm lint)pnpm format:check)pnpm build)Breaking Changes
TURNSTILE_SECRET_KEYon the edge function is unused after this change; Auth CAPTCHA (dashboard) is the correct place for the Turnstile secret.Additional Notes
Ops after this release reaches production: enable Supabase Dashboard → Authentication → Bot and Abuse Protection → CAPTCHA (Cloudflare Turnstile) and paste the Turnstile secret key so GoTrue verifies
captchaToken. Then test with a new Google account (existing accounts never hit Before User Created).