extract out turntile verifier and update tests

Author: cocomarine

app/controllers/api/subscriptions_controller.rb

@@ -4,8 +4,6 @@ module Api
   class SubscriptionsController < ApiController
     before_action :check_cloudflare_turnstile, only: :create
 
-    API_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify'
-
     def create
       # turnstile token is only used for bot check so strip it out before validation and submission
       payload = subscription_params.except(:turnstile_token).to_h
@@ -47,7 +45,14 @@ def create
     def check_cloudflare_turnstile
       return unless Rails.configuration.x.cloudflare_turnstile.enabled
       return if params[:subscription].blank?
-      return if valid_turnstile_token?
+
+      turnstile_check = Subscriptions::TurnstileVerifier.new(
+        token: params.dig(:subscription, :turnstile_token),
+        remote_ip: request.remote_ip,
+        secret_key: Rails.configuration.x.cloudflare_turnstile.secret_key
+      )
+
+      return if turnstile_check.passed?
 
       Rails.logger.warn('[subscriptions#create] outcome=failure error_code=turnstile_verification_failed')
       render json: {
@@ -57,40 +62,6 @@ def check_cloudflare_turnstile
       }, status: :unprocessable_content
     end
 
-    def valid_turnstile_token?
-      token = params.dig(:subscription, :turnstile_token)
-      return false if token.blank?
-
-      response = turnstile_connection.post(
-        API_URL,
-        {
-          secret: Rails.configuration.x.cloudflare_turnstile.secret_key,
-          response: token,
-          remoteip: request.remote_ip
-        }
-      )
-      unless response.success?
-        Rails.logger.warn("[subscriptions#create] turnstile verification skipped: HTTP #{response.status}")
-        return true # fail open
-      end
-
-      JSON.parse(response.body)['success'] == true
-    rescue Faraday::Error, JSON::ParserError => e
-      Sentry.capture_exception(e)
-      Rails.logger.warn("[subscriptions#create] turnstile verification error: #{e.message}")
-      # Fail open to allow the request through if verification is unavailable
-      # due to network issues, Cloudflare downtime or malformed responses etc.
-      true
-    end
-
-    def turnstile_connection
-      Faraday.new do |f|
-        f.request :url_encoded
-        f.options.timeout = 5
-        f.options.open_timeout = 2
-      end
-    end
-
     def subscription_params
       params.require(:subscription).permit(:email, :test_opt_in, :privacy_policy, :turnstile_token)
     end

app/services/subscriptions/turnstile_verifier.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Subscriptions
+  class TurnstileVerifier
+    API_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify'
+
+    def initialize(token:, remote_ip:, secret_key:)
+      @token = token
+      @remote_ip = remote_ip
+      @secret_key = secret_key
+    end
+
+    def passed?
+      return false if @token.blank?
+
+      response = faraday.post(
+        API_URL,
+        {
+          secret: secret_key,
+          response: token,
+          remoteip: remote_ip
+        }
+      )
+      unless response.success?
+        Rails.logger.warn("[subscriptions#create] turnstile verification skipped: HTTP #{response.status}")
+        return true # fail open
+      end
+
+      JSON.parse(response.body)['success'] == true
+    rescue Faraday::Error, JSON::ParserError => e
+      Sentry.capture_exception(e)
+      Rails.logger.warn("[subscriptions#create] turnstile verification error: #{e.message}")
+      # Fail open to allow the request through if verification is unavailable
+      # due to network issues, Cloudflare downtime or malformed responses etc.
+      true
+    end
+
+    private
+
+    attr_reader :secret_key, :remote_ip, :token
+
+    def faraday
+      @faraday ||= Faraday.new do |f|
+        f.request :url_encoded
+        f.options.timeout = 5
+        f.options.open_timeout = 2
+      end
+    end
+  end
+end

spec/requests/api/subscriptions_spec.rb

@@ -115,27 +115,27 @@
     end
 
     describe 'Cloudflare Turnstile integration' do
-      let(:request_url) { Api::SubscriptionsController::API_URL }
-      let(:turnstile_request_body) { { 'secret' => 'test-secret', 'response' => 'test-token', 'remoteip' => '127.0.0.1' } }
-      let(:post_params) { payload }
+      let(:turnstile_check) { instance_double(Subscriptions::TurnstileVerifier, passed?: true) }
 
       before do
         allow(Rails.configuration.x.cloudflare_turnstile).to receive_messages(
           enabled: true,
           secret_key: 'test-secret'
         )
+        allow(Subscriptions::TurnstileVerifier).to receive(:new).and_return(turnstile_check)
       end
 
-      shared_examples 'turnstile verification failure' do
-        it 'returns 422 with turnstile_verification_failed error code' do
-          post(path, params: post_params, as: :json)
+      it 'passes the token, remote IP and secret key to the verifier' do
+        post(path, params: payload, as: :json)
 
-          expect(response).to have_http_status(:unprocessable_content)
-          expect(response.parsed_body['error_code']).to eq('turnstile_verification_failed')
-        end
+        expect(Subscriptions::TurnstileVerifier).to have_received(:new).with(
+          token: 'test-token',
+          remote_ip: '127.0.0.1',
+          secret_key: 'test-secret'
+        )
       end
 
-      shared_examples 'fail-open turnstile response' do
+      context 'when the turnstile check passes' do
         it 'allows the request through' do
           post(path, params: payload, as: :json)
 
@@ -144,66 +144,15 @@
         end
       end
 
-      context 'when turnstile token is missing' do
-        let(:post_params) { payload.deep_merge(subscription: { turnstile_token: '' }) }
-
-        it_behaves_like 'turnstile verification failure'
-      end
-
-      context 'when turnstile verification fails' do
-        before do
-          stub_request(:post, request_url)
-            .with(body: turnstile_request_body)
-            .to_return(status: 200, body: { success: false }.to_json)
-        end
-
-        it_behaves_like 'turnstile verification failure'
-      end
-
-      context 'when turnstile verification times out' do
-        before do
-          stub_request(:post, request_url)
-            .with(body: turnstile_request_body)
-            .to_timeout
-        end
+      context 'when the turnstile check fails' do
+        before { allow(turnstile_check).to receive(:passed?).and_return(false) }
 
-        it 'allows the request through and reports to Sentry' do
+        it 'returns 422 with turnstile_verification_failed error code' do
           post(path, params: payload, as: :json)
 
-          expect(response).to have_http_status(:ok)
-          expect(response.parsed_body['ok']).to be(true)
-          expect(Sentry).to have_received(:capture_exception).with(be_a(Faraday::Error))
-        end
-      end
-
-      context 'when Cloudflare returns a server error' do
-        before do
-          stub_request(:post, request_url)
-            .with(body: turnstile_request_body)
-            .to_return(status: 500, body: 'Internal Server Error')
-        end
-
-        it_behaves_like 'fail-open turnstile response'
-      end
-
-      context 'when Cloudflare returns malformed JSON' do
-        before do
-          stub_request(:post, request_url)
-            .with(body: turnstile_request_body)
-            .to_return(status: 200, body: 'not-json')
-        end
-
-        it_behaves_like 'fail-open turnstile response'
-      end
-
-      context 'when turnstile token is valid' do
-        before do
-          stub_request(:post, request_url)
-            .with(body: turnstile_request_body)
-            .to_return(status: 200, body: { success: true }.to_json)
+          expect(response).to have_http_status(:unprocessable_content)
+          expect(response.parsed_body['error_code']).to eq('turnstile_verification_failed')
         end
-
-        it_behaves_like 'fail-open turnstile response'
       end
     end
   end

spec/services/subscriptions/turnstile_verifier_spec.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Subscriptions::TurnstileVerifier do
+  let(:secret_key) { 'test-secret' }
+  let(:remote_ip) { '127.0.0.1' }
+  let(:token) { 'test-token' }
+  let(:verifier) { described_class.new(token:, remote_ip:, secret_key:) }
+  let(:connection) { instance_double(Faraday::Connection) }
+  let(:response) do
+    instance_double(Faraday::Response, success?: true, status: 200, body: { success: true }.to_json)
+  end
+
+  before do
+    allow(verifier).to receive(:faraday).and_return(connection)
+    allow(connection).to receive(:post).and_return(response)
+    allow(Sentry).to receive(:capture_exception)
+  end
+
+  describe '#passed?' do
+    it 'posts to Cloudflare siteverify with the correct params' do
+      verifier.passed?
+
+      expect(connection).to have_received(:post).with(
+        described_class::API_URL,
+        { secret: secret_key, response: token, remoteip: remote_ip }
+      )
+    end
+
+    context 'when turnstile token is missing' do
+      let(:token) { '' }
+
+      it 'returns false without calling Cloudflare' do
+        expect(verifier.passed?).to be(false)
+        expect(connection).not_to have_received(:post)
+      end
+    end
+
+    context 'when turnstile token is valid' do
+      it { expect(verifier.passed?).to be(true) }
+    end
+
+    context 'when Cloudflare rejects the token' do
+      let(:response) do
+        instance_double(Faraday::Response, success?: true, status: 200, body: { success: false }.to_json)
+      end
+
+      it { expect(verifier.passed?).to be(false) }
+    end
+
+    context 'when Cloudflare returns a server error' do
+      let(:response) do
+        instance_double(Faraday::Response, success?: false, status: 500, body: 'Internal Server Error')
+      end
+
+      it { expect(verifier.passed?).to be(true) }
+    end
+
+    context 'when Cloudflare returns malformed JSON' do
+      let(:response) do
+        instance_double(Faraday::Response, success?: true, status: 200, body: 'not-json')
+      end
+
+      it { expect(verifier.passed?).to be(true) }
+
+      it 'reports the error to Sentry' do
+        verifier.passed?
+        expect(Sentry).to have_received(:capture_exception).with(be_a(JSON::ParserError))
+      end
+    end
+
+    context 'when the Cloudflare connection fails' do
+      before do
+        allow(connection).to receive(:post).and_raise(Faraday::ConnectionFailed.new('connection failed'))
+      end
+
+      it { expect(verifier.passed?).to be(true) }
+
+      it 'reports the error to Sentry' do
+        verifier.passed?
+        expect(Sentry).to have_received(:capture_exception).with(be_a(Faraday::Error))
+      end
+    end
+  end
+end