Back to sign in
diff --git a/public/js/auth.js b/public/js/auth.js
index f697b93..29daa98 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -214,6 +214,71 @@ document.addEventListener('DOMContentLoaded', function() {
}
}
+ // ---- CLOUDFLARE TURNSTILE ----
+ // Gates registration and password reset. Login is deliberately NOT gated:
+ // it is already covered by a 10-per-15-min rate limit and a constant-time
+ // credential check, and the widget is unreliable inside the Capacitor
+ // WebView — which locked mobile users out of the app entirely.
+ //
+ // Tokens are captured from the render callback rather than read back out of
+ // the injected [name="cf-turnstile-response"] input. That lookup is easy to
+ // leave unscoped, which is exactly how the register form ended up
+ // submitting the login widget's token (single-use, 5-minute expiry).
+ //
+ // Rendering is explicit and deferred until the owning form is visible:
+ // both widgets live in forms that start at display:none, and Turnstile does
+ // not reliably complete a challenge inside a hidden container.
+ var turnstileWidgets = {
+ register: { el: 'turnstile-register', id: null, token: '', pending: false },
+ forgot: { el: 'turnstile-forgot', id: null, token: '', pending: false }
+ };
+ var turnstileReady = false;
+
+ // api.js?render=explicit invokes this once the Turnstile API is available.
+ window.onloadTurnstileCallback = function() {
+ turnstileReady = true;
+ Object.keys(turnstileWidgets).forEach(function(name) {
+ // Catch up on any form shown before the script finished loading.
+ if (turnstileWidgets[name].pending) renderTurnstile(name);
+ });
+ };
+
+ function renderTurnstile(name) {
+ var w = turnstileWidgets[name];
+ if (!w || w.id !== null) return; // already rendered
+ var el = document.getElementById(w.el);
+ if (!el) return;
+ if (!turnstileReady || !window.turnstile) { w.pending = true; return; }
+ w.pending = false;
+ w.id = window.turnstile.render(el, {
+ sitekey: el.getAttribute('data-sitekey'),
+ theme: 'light',
+ callback: function(token) { w.token = token; },
+ 'expired-callback': function() { w.token = ''; },
+ 'timeout-callback': function() { w.token = ''; },
+ // Without this a widget failure is silent and the user only ever sees
+ // the generic "complete the verification" toast with no way to tell
+ // whether the challenge failed, expired, or never loaded at all.
+ 'error-callback': function(code) {
+ w.token = '';
+ console.error('[Auth] Turnstile error on ' + name + ' widget:', code);
+ showToast('Verification unavailable (' + (code || 'error') + '). Check your connection and try again.', 'error');
+ }
+ });
+ }
+
+ function turnstileToken(name) {
+ var w = turnstileWidgets[name];
+ return w ? w.token : '';
+ }
+
+ function resetTurnstile(name) {
+ var w = turnstileWidgets[name];
+ if (!w) return;
+ w.token = '';
+ if (w.id !== null && window.turnstile) window.turnstile.reset(w.id);
+ }
+
// ---- HELPER FUNCTIONS ----
function showLoginForm() {
@@ -226,12 +291,14 @@ document.addEventListener('DOMContentLoaded', function() {
if (loginForm) loginForm.style.display = 'none';
if (registerForm) registerForm.style.display = 'block';
if (forgotForm) forgotForm.style.display = 'none';
+ renderTurnstile('register');
}
function showForgotForm() {
if (loginForm) loginForm.style.display = 'none';
if (registerForm) registerForm.style.display = 'none';
if (forgotForm) forgotForm.style.display = 'block';
+ renderTurnstile('forgot');
}
function enterApp(user, token) {
@@ -527,7 +594,7 @@ document.addEventListener('DOMContentLoaded', function() {
// ---- BIOMETRIC LOGIN BUTTON ----
// Reads the email + password from the OS-secured keychain (gated behind
// Face ID / Touch ID / fingerprint) and fills the login form. Submits the
- // form so all the existing flow (turnstile, 2FA prompt, error handling,
+ // form so all the existing flow (2FA prompt, error handling,
// session storage) runs unchanged. If biometric verification fails, the
// user just gets a toast and falls through to typing the password.
var bioBtn = document.getElementById('btn-bio-login');
@@ -544,10 +611,7 @@ document.addEventListener('DOMContentLoaded', function() {
if (emailEl) emailEl.value = creds.username;
if (pwEl) pwEl.value = creds.password;
// Trigger the same submit path as the password form so all the
- // existing handling (turnstile token, 2FA, session storage, etc.)
- // runs unchanged. If turnstile hasn't auto-solved yet the form
- // will toast "Please complete the verification" — same as a
- // manual login attempt before turnstile resolves.
+ // existing handling (2FA, session storage, etc.) runs unchanged.
if (loginForm && typeof loginForm.requestSubmit === 'function') loginForm.requestSubmit();
else if (loginForm) loginForm.dispatchEvent(new Event('submit', { cancelable: true, bubbles: true }));
})
@@ -577,17 +641,9 @@ document.addEventListener('DOMContentLoaded', function() {
return false;
}
- // Cloudflare Turnstile
- var loginTurnstile = document.querySelector('#login-form [name="cf-turnstile-response"]');
- var loginToken = loginTurnstile ? loginTurnstile.value : '';
- if (!loginToken) {
- showToast('Please complete the verification', 'error');
- return false;
- }
-
showLoading('Signing in...');
- var body = { email: email, password: password, turnstileToken: loginToken };
+ var body = { email: email, password: password };
if (totpCode) body.totpCode = totpCode;
fetch('/api/auth/login', {
@@ -637,14 +693,12 @@ document.addEventListener('DOMContentLoaded', function() {
}
} else {
showToast(data.error || 'Login failed', 'error');
- if (window.turnstile) turnstile.reset('#turnstile-login');
}
})
.catch(function(err) {
hideLoading();
console.error('[Auth] Login error:', err);
showToast('Connection error', 'error');
- if (window.turnstile) turnstile.reset('#turnstile-login');
});
return false;
@@ -703,9 +757,8 @@ document.addEventListener('DOMContentLoaded', function() {
}
// Cloudflare Turnstile verification
- var turnstileResponse = document.querySelector('[name="cf-turnstile-response"]');
- var turnstileToken = turnstileResponse ? turnstileResponse.value : '';
- if (!turnstileToken) {
+ var regToken = turnstileToken('register');
+ if (!regToken) {
showToast('Please complete the verification challenge', 'error');
return false;
}
@@ -715,7 +768,7 @@ document.addEventListener('DOMContentLoaded', function() {
fetch('/api/auth/register', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
- body: JSON.stringify({ name: name, email: email, password: password, turnstileToken: turnstileToken })
+ body: JSON.stringify({ name: name, email: email, password: password, turnstileToken: regToken })
})
.then(function(r) { return r.json(); })
.then(function(data) {
@@ -729,17 +782,20 @@ document.addEventListener('DOMContentLoaded', function() {
showToast(data.message || 'Account created!', 'success');
} else if (data.success && data.needsVerification) {
showToast(data.message || 'Check email to verify', 'success');
+ // The token was just consumed server-side — clear it so coming back
+ // to this form doesn't resubmit a spent one.
+ resetTurnstile('register');
showLoginForm();
} else {
showToast(data.error || 'Registration failed', 'error');
- if (window.turnstile) turnstile.reset();
+ resetTurnstile('register');
}
})
.catch(function(err) {
hideLoading();
console.error('[Auth] Register error:', err);
showToast('Connection error', 'error');
- if (window.turnstile) turnstile.reset();
+ resetTurnstile('register');
});
return false;
@@ -756,8 +812,7 @@ document.addEventListener('DOMContentLoaded', function() {
if (!email) { showToast('Enter email', 'error'); return false; }
// Cloudflare Turnstile
- var forgotTurnstile = document.querySelector('#forgot-form [name="cf-turnstile-response"]');
- var forgotToken = forgotTurnstile ? forgotTurnstile.value : '';
+ var forgotToken = turnstileToken('forgot');
if (!forgotToken) {
showToast('Please complete the verification', 'error');
return false;
@@ -774,12 +829,13 @@ document.addEventListener('DOMContentLoaded', function() {
.then(function(data) {
hideLoading();
showToast(data.message || 'Check your email', 'success');
+ resetTurnstile('forgot');
showLoginForm();
})
.catch(function(err) {
hideLoading();
showToast('Error', 'error');
- if (window.turnstile) turnstile.reset('#turnstile-forgot');
+ resetTurnstile('forgot');
});
return false;
diff --git a/src/routes/auth.js b/src/routes/auth.js
index 469951e..3d5aff7 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -299,19 +299,15 @@ router.post('/resend-verification', async (req, res) => {
// ============================================================
router.post('/login', async (req, res) => {
try {
- var { email, password, totpCode, turnstileToken } = req.body;
+ var { email, password, totpCode } = req.body;
if (!email || !password) return res.status(400).json({ error: 'Email and password required' });
- // Cloudflare Turnstile verification
- if (process.env.TURNSTILE_SECRET_KEY) {
- if (!turnstileToken) return res.status(400).json({ error: 'Please complete the verification' });
- var tsRes = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
- method: 'POST', headers: { 'Content-Type': 'application/json' },
- body: JSON.stringify({ secret: process.env.TURNSTILE_SECRET_KEY, response: turnstileToken, remoteip: req.ip })
- });
- var tsData = await tsRes.json();
- if (!tsData.success) return res.status(400).json({ error: 'Verification failed. Please try again.' });
- }
+ // No Turnstile on login. The widget could not reliably complete a
+ // challenge inside the Capacitor WebView, which locked mobile users out.
+ // Brute-force cover here comes from the 10-per-15-min per-IP rate limit
+ // (server.js), the constant-time bcrypt comparison below, and TOTP 2FA.
+ // Registration and password reset — the endpoints that actually attract
+ // bots — are still gated.
var user = await db.get('SELECT * FROM users WHERE email = ?', [email.toLowerCase()]);
// Enumeration-resistant: always run bcrypt to keep timing constant, and return