From dede8a3f6c119f8e1c6ac843eefed20191106437 Mon Sep 17 00:00:00 2001 From: "Beau Beauchamp, WebTigers" Date: Sun, 25 Oct 2026 03:46:54 -0400 Subject: [PATCH] Un-gate the captcha-blocked auth checks: turn reCAPTCHA off on the test install (TIGER-385) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The probe's GATED footer told the operator the three captcha-blocked checks could not be un-gated by any configuration, and belonged to a headless browser run instead. That was wrong. `tiger.recaptcha.enabled = 0` is a first-class state in `Tiger_Recaptcha` — the control renders nothing and the validator passes, by design, so a keyless dev install just works — and with it off all three run for real against the same code prod runs. It matters because of WHICH three: AUTH-04 (a failed login is refused with a JSON envelope), AUTH-05 (login does not enumerate accounts) and AUTH-07 (a reset request does not enumerate accounts) are the probe's three `blocker`-severity checks. They were the assertions least able to afford being inconclusive. Verified both ways on dev rather than asserted: with reCAPTCHA ON the footer renders and reports 3 GATED; with it OFF the run is 13 checks, 0 failed, 0 GATED, and a real headless login (`identifier`+`password`, no captcha token) returns `{"result":1,"redirect":"/account"}` and a 200 on an authenticated page. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013vdyTeoDrGE4hKxt53TsE8 --- tests/ui/bin/auth-probe.php | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tests/ui/bin/auth-probe.php b/tests/ui/bin/auth-probe.php index f6a60d26..ee60afa0 100644 --- a/tests/ui/bin/auth-probe.php +++ b/tests/ui/bin/auth-probe.php @@ -178,10 +178,14 @@ function asJson(array $r): ?array { $d = json_decode(trim($r['body']), true); re printf("\n%d checks, %d failed, %d GATED (reCAPTCHA refused a tokenless client — those assertions never ran)\n", count($results), count($fail), $gatedN); if ($gatedN) { - echo "\nThese are inconclusive, not green — and no configuration un-gates them (TIGER-385: dev runs\n" - . "reCAPTCHA v3 to match prod, v3 needs a BROWSER-executed token, and Google's always-pass test\n" - . "keys are v2-only). curl has no token, not a low score. They belong to the headless browser\n" - . "probe instead, which mints a real token; GATED is this tool's honest answer.\n"; + echo "\nThese are inconclusive, not green. reCAPTCHA v3 mints its token in a BROWSER, so curl can\n" + . "never carry one — and Google's always-pass test keys are v2-only, so there is no token to\n" + . "fake. The fix is not a browser: switch reCAPTCHA OFF on the test install (TIGER-385). It is\n" + . "one config value, and the keys are left in place so re-enabling is the same one value:\n\n" + . " tiger.recaptcha.enabled = 0 ; Settings -> System -> reCAPTCHA, or the config tier\n\n" + . "Off is a first-class state in Tiger_Recaptcha — the control renders nothing and the validator\n" + . "passes — so every check above then runs for real against the same code prod runs. Leave it ON\n" + . "and these stay GATED, which is this tool's honest answer rather than a vacuous pass.\n"; } } exit(count($fail) ? 1 : 0);