fix: remove fragile auth test bypasses

Remove the hard-coded development hCaptcha token bypass and temporary email-confirmation mutation from Identity login/register page handlers. Local testing should use the configured hCaptcha test keys or test-host service overrides instead of changing production auth flow code.

Author: BenjaminMichaelis

EssentialCSharp.Web/Areas/Identity/Pages/Account/Login.cshtml.cs

@@ -4,15 +4,14 @@
 using EssentialCSharp.Web.Services;
 using EssentialCSharp.Web.Services.Referrals;
 using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.Extensions.Options;
 
 namespace EssentialCSharp.Web.Areas.Identity.Pages.Account;
 
-public partial class LoginModel(SignInManager<EssentialCSharpWebUser> signInManager, UserManager<EssentialCSharpWebUser> userManager, ILogger<LoginModel> logger, IReferralService referralService, ICaptchaService captchaService, IOptions<CaptchaOptions> optionsAccessor, IWebHostEnvironment environment) : PageModel
+public partial class LoginModel(SignInManager<EssentialCSharpWebUser> signInManager, UserManager<EssentialCSharpWebUser> userManager, ILogger<LoginModel> logger, IReferralService referralService, ICaptchaService captchaService, IOptions<CaptchaOptions> optionsAccessor) : PageModel
 {
     private InputModel? _Input;
     [BindProperty]
@@ -69,13 +68,8 @@ public async Task<IActionResult> OnPostAsync(string? returnUrl = null)
         returnUrl ??= Url.Content("~/");
 
         string? captchaToken = Request.Form[CaptchaOptions.HttpPostResponseKeyName];
-        
-        // Development-only bypass for E2E testing: allow test tokens without verification.
-        bool isTestToken = environment.IsDevelopment() && captchaToken == "10000000-aaaa-bbbb-cccc-000000000001";
-        
-        HCaptchaResult? captchaResult = isTestToken 
-            ? new HCaptchaResult { Success = true } 
-            : await captchaService.VerifyAsync(captchaToken, HttpContext.Connection.RemoteIpAddress?.ToString());
+
+        HCaptchaResult? captchaResult = await captchaService.VerifyAsync(captchaToken, HttpContext.Connection.RemoteIpAddress?.ToString());
 
         if (captchaResult?.Success != true)
         {
@@ -100,19 +94,7 @@ public async Task<IActionResult> OnPostAsync(string? returnUrl = null)
             }
             if (foundUser is not null)
             {
-                // For test tokens, bypass email confirmation requirement
-                if (isTestToken && !foundUser.EmailConfirmed)
-                {
-                    // Temporarily set email as confirmed for this sign-in when using test token
-                    var tempConfirmed = foundUser.EmailConfirmed;
-                    foundUser.EmailConfirmed = true;
-                    result = await signInManager.PasswordSignInAsync(foundUser, Input.Password, Input.RememberMe, lockoutOnFailure: true);
-                    foundUser.EmailConfirmed = tempConfirmed;
-                }
-                else
-                {
-                    result = await signInManager.PasswordSignInAsync(foundUser, Input.Password, Input.RememberMe, lockoutOnFailure: true);
-                }
+                result = await signInManager.PasswordSignInAsync(foundUser, Input.Password, Input.RememberMe, lockoutOnFailure: true);
                 // Call the referral service to get the referral ID and set it onto the user claim
                 _ = await referralService.EnsureReferralIdAsync(foundUser);
             }

EssentialCSharp.Web/Areas/Identity/Pages/Account/Register.cshtml.cs

@@ -5,7 +5,6 @@
 using EssentialCSharp.Web.Models;
 using EssentialCSharp.Web.Services;
 using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Identity.UI.Services;
 using Microsoft.AspNetCore.Mvc;
@@ -23,8 +22,7 @@ public partial class RegisterModel(
     IEmailSender emailSender,
     ICaptchaService captchaService,
     IOptions<CaptchaOptions> optionsAccessor,
-    IUserEmailStore<EssentialCSharpWebUser> emailStore,
-    IWebHostEnvironment environment) : PageModel
+    IUserEmailStore<EssentialCSharpWebUser> emailStore) : PageModel
 {
     public string CaptchaSiteKey { get; } = optionsAccessor.Value.SiteKey ?? string.Empty;
 
@@ -97,12 +95,7 @@ public async Task<IActionResult> OnPostAsync(string? returnUrl = null)
             return Page();
         }
 
-        // Development-only bypass for E2E testing: allow test tokens without verification.
-        bool isTestToken = environment.IsDevelopment() && hCaptcha_response == "10000000-aaaa-bbbb-cccc-000000000001";
-        
-        HCaptchaResult? response = isTestToken 
-            ? new HCaptchaResult { Success = true } 
-            : await captchaService.VerifyAsync(hCaptcha_response, HttpContext.Connection.RemoteIpAddress?.ToString());
+        HCaptchaResult? response = await captchaService.VerifyAsync(hCaptcha_response, HttpContext.Connection.RemoteIpAddress?.ToString());
 
         if (response is null)
         {