captchaforge 0.2.38

//! Integration tests against a real headless browser.
//!
//! These tests spin up a local HTTP server with mock CAPTCHA HTML pages,
//! launch chromiumoxide, and verify that `detect` and `solve` behave
//! correctly against real DOM.

use captchaforge::detect::{detect, is_captcha, DetectedCaptcha};
use captchaforge::solver::{
    BehavioralCaptchaSolver, CaptchaSolver, CaptchaSolverChain, SolveConfig,
};

mod common;

#[tokio::test]
async fn detect_turnstile_on_mock_page() {
    let browser = common::launch_browser().await;
    let page = browser.new_page("about:blank").await.unwrap();

    // Inject a mock Turnstile widget into the page.
    let js = r#"
        document.body.innerHTML = '<div class="cf-turnstile" data-sitekey="0xTEST"></div>' +
            '<script src="https://challenges.cloudflare.com/turnstile/v0/api.js"></script>';
        "true"
    "#;
    let _: String = page.evaluate(js).await.unwrap().into_value().unwrap();

    let info = detect(&page).await.unwrap();
    assert!(is_captcha(&info));
    assert_eq!(info.kind, DetectedCaptcha::Turnstile);
    assert_eq!(info.site_key, Some("0xTEST".to_string()));

    browser.close().await.unwrap();
}

#[tokio::test]
async fn detect_recaptcha_v2_on_mock_page() {
    let browser = common::launch_browser().await;
    let page = browser.new_page("about:blank").await.unwrap();

    let js = r#"
        document.body.innerHTML = '<div class="g-recaptcha" data-sitekey="test-key-123"></div>' +
            '<script src="https://www.google.com/recaptcha/api.js"></script>';
        "true"
    "#;
    let _: String = page.evaluate(js).await.unwrap().into_value().unwrap();

    let info = detect(&page).await.unwrap();
    assert!(is_captcha(&info));
    assert_eq!(info.kind, DetectedCaptcha::RecaptchaV2);
    assert_eq!(info.site_key, Some("test-key-123".to_string()));

    browser.close().await.unwrap();
}

#[tokio::test]
async fn detect_none_on_plain_page() {
    let browser = common::launch_browser().await;
    let page = browser.new_page("about:blank").await.unwrap();

    let info = detect(&page).await.unwrap();
    assert!(!is_captcha(&info));
    assert_eq!(info.kind, DetectedCaptcha::None);

    browser.close().await.unwrap();
}

#[tokio::test]
async fn chain_falls_through_on_unknown_captcha() {
    let browser = common::launch_browser().await;
    let page = browser.new_page("about:blank").await.unwrap();

    // Inject a plain page with no captcha.
    let _: String = page
        .evaluate("document.body.innerHTML = '<h1>Hello</h1>'; 'done'")
        .await
        .unwrap()
        .into_value()
        .unwrap();

    let info = detect(&page).await.unwrap();
    // Even though there's no captcha, run the chain to verify it doesn't panic.
    let chain = CaptchaSolverChain::default_chain();
    let result = chain.solve(&page, &info).await;
    assert!(!result.success);

    browser.close().await.unwrap();
}

#[tokio::test]
async fn detect_challenge_page_title() {
    let browser = common::launch_browser().await;
    let page = browser.new_page("about:blank").await.unwrap();

    let js = r#"
        document.title = 'Just a moment...';
        document.body.innerHTML = '<form id="challenge-form"></form>';
        "true"
    "#;
    let _: String = page.evaluate(js).await.unwrap().into_value().unwrap();

    let info = detect(&page).await.unwrap();
    assert!(is_captcha(&info));
    assert_eq!(info.kind, DetectedCaptcha::Turnstile);

    browser.close().await.unwrap();
}

#[tokio::test]
async fn solve_config_custom_timeouts_work() {
    let config = SolveConfig {
        checkbox_poll_interval_ms: 100,
        checkbox_max_attempts: 3,
        token_poll_interval_ms: 100,
        token_max_attempts: 3,
        audio_button_delay_ms: 100,
        audio_submit_delay_ms: 100,
        vlm_http_timeout_ms: 1000,
        client_http_timeout_ms: 1000,
    };

    // Just verify the config struct builds and fields are accessible.
    assert_eq!(config.checkbox_max_attempts, 3);
    assert_eq!(config.vlm_http_timeout_ms, 1000);
}

// ─── Real end-to-end Turnstile solve test ───────────────────────────────────

/// Cloudflare Turnstile public "always pass" test site key.
/// https://developers.cloudflare.com/turnstile/troubleshooting/testing/
const TURNSTILE_TEST_KEY: &str = "1x00000000000000000000AA";

#[tokio::test]
async fn e2e_turnstile_behavioral_solve() {
    let browser = common::launch_browser().await;

    // Serve a real Turnstile widget page on localhost.
    let html = format!(
        r#"<!DOCTYPE html>
<html>
<head><title>Turnstile Test</title></head>
<body>
  <h1>Test Page</h1>
  <div class="cf-turnstile" data-sitekey="{}"></div>
  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
</body>
</html>"#,
        TURNSTILE_TEST_KEY
    );
    let addr = common::serve_once(html).await;
    let url = format!("http://{}", addr);

    let page = browser.new_page(&url).await.unwrap();

    // Give the Turnstile script time to load and inject the iframe.
    tokio::time::sleep(std::time::Duration::from_secs(2)).await;

    // Detection should find Turnstile.
    let info = detect(&page).await.unwrap();
    assert!(is_captcha(&info), "Turnstile should be detected");
    assert_eq!(info.kind, DetectedCaptcha::Turnstile);

    // Attempt behavioural solve.
    let solver = BehavioralCaptchaSolver::new();
    let result = solver.solve(&page, &info).await.unwrap();

    // The test key always passes, so we expect success.
    assert!(
        result.success,
        "Turnstile behavioural solve should succeed with test key: got {:?}",
        result
    );
    // After GAP-1 (round-38) the behavioral solver returns the
    // ACTUAL vendor token harvested from cf-turnstile-response,
    // not a label. Cloudflare's always-pass test sitekey returns
    // the literal placeholder `XXXX.DUMMY.TOKEN.XXXX`. The contract:
    // success=true ⇒ solution is non-empty AND is either a real-
    // looking vendor token (length > 8, dot-separated) OR a
    // documented fallback label.
    assert!(
        !result.solution.is_empty(),
        "solution must be non-empty on success: {result:?}"
    );
    assert!(
        result.solution.len() >= 8,
        "solution too short to be a real or labelled outcome: {:?}",
        result.solution
    );

    browser.close().await.unwrap();
}

/// If the user sets `TURNSTILE_SITE_KEY` in the environment, run a solve
/// against their real key.  This is gated behind both `#[ignore]` and a
/// runtime check so it never runs in CI.
#[tokio::test]
#[ignore = "requires Chrome binary + network + real Turnstile key"]
async fn e2e_turnstile_real_key_solve() {
    let site_key = match std::env::var("TURNSTILE_SITE_KEY") {
        Ok(k) if !k.is_empty() => k,
        _ => {
            eprintln!("Skipping: TURNSTILE_SITE_KEY not set");
            return;
        }
    };

    let browser = common::launch_browser().await;

    let html = format!(
        r#"<!DOCTYPE html>
<html>
<head><title>Turnstile Real Key</title></head>
<body>
  <h1>Real Key Test</h1>
  <div class="cf-turnstile" data-sitekey="{}"></div>
  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
</body>
</html>"#,
        site_key
    );
    let addr = common::serve_once(html).await;
    let url = format!("http://{}", addr);

    let page = browser.new_page(&url).await.unwrap();
    tokio::time::sleep(std::time::Duration::from_secs(2)).await;

    let info = detect(&page).await.unwrap();
    assert!(is_captcha(&info));

    let solver = BehavioralCaptchaSolver::new();
    let result = solver.solve(&page, &info).await.unwrap();

    // With a real key we don't assert success — Turnstile may still block
    // headless browsers — but we do assert the solver returned gracefully.
    tracing::info!(success = result.success, solution = %result.solution, "real key solve finished");

    browser.close().await.unwrap();
}

/// GAP-1 contract test: when a Turnstile widget pre-populates the
/// `cf-turnstile-response` field, the BehavioralSolver MUST return
/// the REAL token value as `solution` — not the historical
/// "behavioral:pre-pass" / "turnstile:behavioral" label strings
/// which `siteverify` would always reject.
#[tokio::test]
async fn behavioral_solver_returns_real_harvested_token_not_label() {
    let browser = common::launch_browser().await;
    let page = browser.new_page("about:blank").await.unwrap();

    // Inject a Turnstile-shaped widget + pre-populate the response
    // field with a deterministic synthetic token. The solver should
    // observe the token via `harvest_token_in_frames` and return THAT
    // string, not a label.
    let synthetic_token = "0.AAAA.synthetic-real-looking-cf-turnstile-token.BBBB";
    let js = format!(
        r#"
        document.body.innerHTML = '<div class="cf-turnstile" data-sitekey="0xTEST"></div>' +
            '<input type="hidden" name="cf-turnstile-response" id="cf-turnstile-response" value="{synthetic_token}">';
        "true"
    "#
    );
    let _: String = page
        .evaluate(js.as_str())
        .await
        .unwrap()
        .into_value()
        .unwrap();

    let info = detect(&page).await.unwrap();
    assert!(is_captcha(&info));
    assert_eq!(info.kind, DetectedCaptcha::Turnstile);

    let solver = BehavioralCaptchaSolver::new();
    let result = solver.solve(&page, &info).await.unwrap();

    assert!(
        result.success,
        "pre-populated token should be harvested as success"
    );
    assert_eq!(
        result.solution, synthetic_token,
        "solution must be the harvested token value, not a label string. \
         got: {:?}",
        result.solution
    );
    assert!(
        !result.solution.starts_with("behavioral:"),
        "solution must NOT be a label string starting with 'behavioral:': {:?}",
        result.solution
    );
    assert!(
        !result.solution.contains(":pre-pass") && !result.solution.contains(":doom"),
        "solution must NOT contain hardcoded path labels: {:?}",
        result.solution
    );

    browser.close().await.unwrap();
}

/// GAP-1 contract test: when a reCAPTCHA-shaped page pre-populates
/// the `g-recaptcha-response` textarea, the solver must return the
/// real token (not "recaptcha_v2:behavioral").
#[tokio::test]
async fn behavioral_solver_returns_real_recaptcha_token_not_label() {
    let browser = common::launch_browser().await;
    let page = browser.new_page("about:blank").await.unwrap();

    let synthetic_token = "03AGdBq25-synthetic-recaptcha-token-value-for-test";
    let js = format!(
        r#"
        document.body.innerHTML = '<div class="g-recaptcha" data-sitekey="6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI"></div>' +
            '<textarea name="g-recaptcha-response" id="g-recaptcha-response">{synthetic_token}</textarea>';
        "true"
    "#
    );
    let _: String = page
        .evaluate(js.as_str())
        .await
        .unwrap()
        .into_value()
        .unwrap();

    let info = detect(&page).await.unwrap();
    assert!(is_captcha(&info));

    let solver = BehavioralCaptchaSolver::new();
    let result = solver.solve(&page, &info).await.unwrap();

    assert!(result.success);
    assert_eq!(result.solution, synthetic_token);
    assert!(
        !result.solution.starts_with("recaptcha_v"),
        "solution must NOT be a label string: {:?}",
        result.solution
    );

    browser.close().await.unwrap();
}