Prevent registration spam with Turnstile #1015

Merged

jimmyb merged 1 commit from codex/issue-999-registration-spam-prevention into master

2026-11-05 11:58:40 -06:00

Codex commented

2026-11-05 11:37:46 -06:00

Member

Prevent automated registrations with managed Turnstile verified server-side before account creation, Fider provisioning, or registration delivery.

Preserve existing validation, IP throttling, auditing, and successful provisioning. Add accessible challenge recovery, responsive/theme-aware widgets, sanitized diagnostics, and setup/rollback documentation. Also limit verification-email resends to one per minute and five per hour per account while keeping verification links challenge-free.

Verification:

Focused PHP tests: 129 passed.
Full PHP suite: 1,549 passed, 2 skipped (--env=testing -d memory_limit=1G); existing duplicate-constant warnings remain.
Playwright registration, verification-email, and shared-JavaScript checks: 20 passed.
Pint, PHPStan, asset build, and whitespace checks passed.

Deployment requires TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY, and TURNSTILE_ALLOWED_HOSTNAMES before enabling this release; missing configuration blocks registration. Live Cloudflare verification remains a deployment-time check. No new dependencies or database migrations.

Fixes #999

Prevent automated registrations with managed Turnstile verified server-side before account creation, Fider provisioning, or registration delivery. Preserve existing validation, IP throttling, auditing, and successful provisioning. Add accessible challenge recovery, responsive/theme-aware widgets, sanitized diagnostics, and setup/rollback documentation. Also limit verification-email resends to one per minute and five per hour per account while keeping verification links challenge-free. Verification: - Focused PHP tests: 129 passed. - Full PHP suite: 1,549 passed, 2 skipped (`--env=testing -d memory_limit=1G`); existing duplicate-constant warnings remain. - Playwright registration, verification-email, and shared-JavaScript checks: 20 passed. - Pint, PHPStan, asset build, and whitespace checks passed. Deployment requires `TURNSTILE_SITE_KEY`, `TURNSTILE_SECRET_KEY`, and `TURNSTILE_ALLOWED_HOSTNAMES` before enabling this release; missing configuration blocks registration. Live Cloudflare verification remains a deployment-time check. No new dependencies or database migrations. Fixes #999

Rows
Columns