feat(recaptcha): propagate verification errors to error handler

recaptcha.go

@@ -28,6 +28,7 @@ package handlers
 
 import (
 	"net/http"
+	"strings"
 
 	"github.com/faryon93/util"
 	"github.com/haisum/recaptcha"
@@ -51,7 +52,6 @@ type recaptchaInput struct {
 // If the verification failes the processing of the request is canceled.
 // If the key parameter is empty, the captcha check is bypassed.
 func Recaptcha(key string, opts ...interface{}) Adapter {
-	captcha := recaptcha.R{Secret: key}
 	httpError := opt.GetErrorHandler(opts)
 
 	return func(h http.Handler) http.Handler {
@@ -69,9 +69,10 @@ func Recaptcha(key string, opts ...interface{}) Adapter {
 				}
 
 				// verfiy the captcha with the captcha server
+				captcha := recaptcha.R{Secret: key}
 				ok := captcha.VerifyResponse(form.Response)
 				if !ok {
-					httpError(w, "invalid recaptcha response", http.StatusBadRequest)
+					httpError(w, recaptchaError(&captcha), http.StatusBadRequest)
 					return
 				}
 
@@ -82,3 +83,16 @@ func Recaptcha(key string, opts ...interface{}) Adapter {
 		})
 	}
 }
+// ---------------------------------------------------------------------------------------
+//  private functions
+// ---------------------------------------------------------------------------------------
+
+// recaptchaError properly formats the last recaptcha errors.
+func recaptchaError(captcha *recaptcha.R) string {
+	errors := captcha.LastError()
+	if len(errors) <= 1 {
+		return "unknown"
+	}
+
+	return strings.Join(errors[1:], ", ")
+}

recaptcha_test.go

@@ -0,0 +1,108 @@
+package handlers
+
+// handlers
+// Copyright (C) 2019 Maximilian Pachl
+
+// MIT License
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+// ---------------------------------------------------------------------------------------
+//  imports
+// ---------------------------------------------------------------------------------------
+
+import (
+    "net/http"
+    "net/http/httptest"
+    "strings"
+    "testing"
+)
+
+// ---------------------------------------------------------------------------------------
+//  constants
+// ---------------------------------------------------------------------------------------
+
+const (
+    BodyPassed = "passed"
+)
+
+
+// ---------------------------------------------------------------------------------------
+//  tests
+// ---------------------------------------------------------------------------------------
+
+func TestRecaptchaNoKey(t *testing.T) {
+    rr := httptest.NewRecorder()
+    req, err := http.NewRequest(http.MethodGet, "/", nil)
+    if err != nil {
+        t.Fatal(err)
+    }
+
+    Recaptcha("")(GetTestHandler()).ServeHTTP(rr, req)
+    if rr.Code != http.StatusOK {
+        t.Errorf("excepted http status to be %d but is %d", http.StatusOK, rr.Code)
+        return
+    }
+
+    if rr.Body.String() != BodyPassed {
+        t.Errorf("excepted body \"%s\" but got \"%s\"",
+            BodyPassed, rr.Body.String())
+        return
+    }
+}
+
+func TestRecaptchaInvalidResponse(t *testing.T) {
+    bodies := []string{
+        "",
+        "{}",
+        "{\"test\": 12}",
+        "{\"g-recaptcha-response\": \"test\"}",
+    }
+
+    for _, body := range bodies {
+        rr := httptest.NewRecorder()
+        req, err := http.NewRequest(http.MethodGet, "/", strings.NewReader(body))
+        if err != nil {
+            t.Fatal(err)
+        }
+
+        Recaptcha("test")(GetTestHandler()).ServeHTTP(rr, req)
+        if rr.Code != http.StatusBadRequest {
+            t.Errorf("excepted http status to be %d but is %d: middleware did not prevent handler exeution",
+                http.StatusBadRequest, rr.Code)
+            return
+        }
+
+        if rr.Body.String() == BodyPassed {
+            t.Errorf("excepted body \"%s\" but got \"%s\": middleware did not prevent handler exeution",
+                BodyPassed, rr.Body.String())
+            return
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------------------
+//  helpers
+// ---------------------------------------------------------------------------------------
+
+// GetTestHandler returns a http.HandlerFunc for testing http middleware
+func GetTestHandler() http.HandlerFunc {
+    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+        _, _ = w.Write([]byte(BodyPassed))
+    })
+}