Feat | Migrate from Google reCAPTCHA to Cloudflare Turnstile

.env.example

@@ -58,8 +58,8 @@ LOG_LEVEL=info
 
 EVENTBRITE_OAUTH2_PERSONAL_TOKEN=
 
-RECAPTCHA_PUBLIC_KEY=
-RECAPTCHA_PRIVATE_KEY=
+TURNSTILE_SECRET_KEY=
+TURNSTILE_SITE_KEY=
 
 BANNING_ENABLE=
 SUPPORT_EMAIL=

.github/workflows/pull_request_unit_tests.yml

@@ -63,6 +63,9 @@ jobs:
         env:
           COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.PAT }}"} }'
       - name: 'Run Tests'
+        env:
+          TEST_USER_EMAIL: ${{ secrets.TEST_USER_EMAIL }}
+          TEST_USER_PASSWORD: ${{ secrets.TEST_USER_PASSWORD }}
         run: |
           ./update_doctrine.sh
           php artisan doctrine:migrations:migrate --no-interaction

.github/workflows/push.yml

@@ -61,6 +61,9 @@ jobs:
          env:
            COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.PAT }}"} }'
        - name: 'Run Tests'
+         env:
+           TEST_USER_EMAIL: ${{ secrets.TEST_USER_EMAIL }}
+           TEST_USER_PASSWORD: ${{ secrets.TEST_USER_PASSWORD }}
          run: |
            ./update_doctrine.sh
            php artisan doctrine:migrations:migrate --no-interaction

.nvmrc

@@ -1 +1 @@
-18.20.2
+22.22.2

Dockerfile

@@ -2,7 +2,7 @@ FROM php:8.3-fpm
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG NVM_VERSION="v0.40.3"
-ENV NODE_VERSION="18.20.4"
+ENV NODE_VERSION="22.22.2"
 ARG YARN_VERSION="1.22.22"
 ARG GITHUB_OAUTH_TOKEN
 ARG XDEBUG_VERSION="xdebug-3.3.2"

app/Http/Controllers/Auth/EmailVerificationController.php

@@ -13,6 +13,7 @@
  **/
 use App\Http\Controllers\Controller;
 use App\libs\Utils\EmailUtils;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Services\Auth\IUserService;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Redirect;
@@ -87,7 +88,7 @@ protected function validator(array $data)
     {
         return Validator::make($data, [
             'email'                    => 'required|string|email|max:255',
-            'g-recaptcha-response'     => 'required|recaptcha',
+            'cf-turnstile-response'    => ['required', new Turnstile()],
         ]);
     }
 
@@ -100,7 +101,6 @@ public function resend(LaravelRequest $request)
             if (!$validator->passes()) {
                 return Redirect::action('Auth\EmailVerificationController@showVerificationForm')->withErrors($validator);
             }
-
             $user = $this->user_service->resendVerificationEmail($payload);
 
             return view("auth.email_verification_resend_success", ['user' => $user]);

app/Http/Controllers/Auth/ForgotPasswordController.php

@@ -13,6 +13,7 @@
  **/
 
 use App\Http\Controllers\Controller;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\libs\Utils\EmailUtils;
 use App\Services\Auth\IUserService;
 use Illuminate\Support\Facades\Log;
@@ -162,6 +163,7 @@ protected function validator(array $data)
     {
         return Validator::make($data, [
             'email' => 'required|string|email|max:255',
+            'cf-turnstile-response' => ['required', new Turnstile()],
         ]);
     }
 

app/Http/Controllers/Auth/PasswordSetController.php

@@ -13,6 +13,7 @@
  **/
 
 use App\Http\Controllers\Controller;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Http\Utils\CountryList;
 use App\libs\Auth\Repositories\IUserRegistrationRequestRepository;
 use App\Services\Auth\IUserService;
@@ -155,7 +156,7 @@ protected function validator(array $data)
             'company' => 'sometimes|string|max:100',
             'country_iso_code' => 'required|string|country_iso_alpha2_code',
             'password' => 'required|string|confirmed|password_policy',
-            'g-recaptcha-response' => 'required|recaptcha',
+            'cf-turnstile-response' => ['required', new Turnstile()],
         ]);
     }
 

app/Http/Controllers/Auth/RegisterController.php

@@ -13,6 +13,7 @@
  **/
 use App\Http\Controllers\Controller;
 use App\Http\Utils\CountryList;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Services\Auth\IUserService;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Config;
@@ -177,7 +178,7 @@ protected function validator(array $data)
             'country_iso_code'         => 'required|string|country_iso_alpha2_code',
             'email'                    => 'required|string|email|max:255',
             'password'                 => 'required|string|confirmed|password_policy',
-            'g-recaptcha-response'     => 'required|recaptcha',
+            'cf-turnstile-response'    => ['required', new Turnstile()],
         ];
 
         if(!empty(Config::get("app.code_of_conduct_link", null))){

app/Http/Controllers/Auth/ResetPasswordController.php

@@ -13,6 +13,7 @@
  **/
 use App\Http\Controllers\Controller;
 use App\libs\Auth\Repositories\IUserPasswordResetRequestRepository;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Services\Auth\IUserService;
 use Auth\Exceptions\UserPasswordResetRequestVoidException;
 use Illuminate\Support\Facades\Log;
@@ -113,7 +114,7 @@ protected function validator(array $data)
         return Validator::make($data, [
             'token'                    => 'required',
             'password'                 => 'required|string|confirmed|password_policy',
-            'g-recaptcha-response'     => 'required|recaptcha',
+            'cf-turnstile-response'    => ['required', new Turnstile()],
         ]);
     }
 

app/Http/Controllers/UserController.php

@@ -13,6 +13,7 @@
  **/
 
 use App\Http\Controllers\OpenId\DiscoveryController;
+use RyanChandler\LaravelCloudflareTurnstile\Rules\Turnstile;
 use App\Jobs\RevokeUserGrantsOnExplicitLogout;
 use App\Http\Controllers\OpenId\OpenIdController;
 use App\Http\Controllers\Traits\JsonResponses;
@@ -420,7 +421,7 @@ public function postLogin()
             ];
 
             if ($login_attempts >= $max_login_attempts_2_show_captcha) {
-                $rules['g-recaptcha-response'] = 'required|recaptcha';
+                $rules['cf-turnstile-response'] = ['required', new Turnstile()];
             }
             // Create a new validator instance.
             $validator = Validator::make($data, $rules);

app/Providers/AppServiceProvider.php

@@ -13,13 +13,15 @@
  **/
 
 use App\libs\Utils\TextUtils;
+use App\Services\TurnstileClient;
 use Illuminate\Support\Facades\App;
 use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Support\Facades\Validator;
 use models\exceptions\ValidationException;
+use RyanChandler\LaravelCloudflareTurnstile\Contracts\ClientInterface;
 use Sokil\IsoCodes\IsoCodesFactory;
 use Validators\CustomValidator;
 use App\Http\Utils\Log\LaravelMailerHandler;
@@ -142,6 +144,9 @@ public function boot()
      */
     public function register()
     {
-        //
+        // Override vendor Client v3.0.3 whose siteverify() has inverted logic.
+        $this->app->scoped(ClientInterface::class, function ($app) {
+            return new TurnstileClient($app['config']->get('services.turnstile.secret'));
+        });
     }
 }

app/Services/TurnstileClient.php

@@ -0,0 +1,58 @@
+<?php
+namespace App\Services;
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+use Illuminate\Support\Facades\Http;
+use RyanChandler\LaravelCloudflareTurnstile\Contracts\ClientInterface;
+use RyanChandler\LaravelCloudflareTurnstile\Responses\SiteverifyResponse;
+
+/**
+ * Replaces the vendor Client (v3.0.3) whose siteverify() has inverted
+ * success/failure logic: it returns success() on HTTP non-2xx and failure()
+ * on HTTP 2xx, causing a TypeError when Cloudflare returns {success:true}.
+ */
+final class TurnstileClient implements ClientInterface
+{
+    public function __construct(private string $secret)
+    {
+    }
+
+    public function siteverify(string $token): SiteverifyResponse
+    {
+        $response = Http::retry(3, 100)
+            ->asForm()
+            ->acceptJson()
+            ->post('https://challenges.cloudflare.com/turnstile/v0/siteverify', [
+                'secret' => $this->secret,
+                'response' => $token,
+                'remoteip' => request()->ip(),
+                'idempotency_key' => uniqid('', true),
+            ]);
+
+        if (!$response->ok()) {
+            return SiteverifyResponse::failure(['http-error']);
+        }
+
+        if ($response->json('success') === true) {
+            return SiteverifyResponse::success();
+        }
+
+        return SiteverifyResponse::failure($response->json('error-codes') ?: ['internal-error']);
+    }
+
+    public function dummy(): string
+    {
+        return self::RESPONSE_DUMMY_TOKEN;
+    }
+}

composer.json

@@ -11,12 +11,6 @@
   ],
   "license": "MIT",
   "type": "project",
-  "repositories": [
-    {
-      "type": "vcs",
-      "url": "https://github.com/smarcet/recaptcha"
-    }
-  ],
   "require": {
     "php": "^8.3",
     "ext-json": "*",
@@ -29,7 +23,6 @@
     "firebase/php-jwt": "6.11.1",
     "get-stream/stream-chat": "^3.10.0",
     "glenscott/url-normalizer": "1.4.0",
-    "greggilbert/recaptcha": "dev-master",
     "guzzlehttp/guzzle": "7.9.3",
     "guzzlehttp/uri-template": "^1.0",
     "ircmaxell/random-lib": "1.2.0",
@@ -49,6 +42,7 @@
     "php-opencloud/openstack": "3.10.0",
     "phpseclib/phpseclib": "^3.0.43",
     "predis/predis": "v2.2.2",
+    "ryangjchandler/laravel-cloudflare-turnstile": "~3.0.3",
     "s-ichikawa/laravel-sendgrid-driver": "^4.0",
     "smarcet/jose4php": "2.0.0",
     "socialiteproviders/apple": "^5.6.1",