better turnstile debug

server/main.py

@@ -60,9 +60,10 @@ async def lifespan(_app: fastapi.FastAPI) -> typing.AsyncIterator[State]:
     session_maker = async_sessionmaker(engine)
     try:
         await db_connection_check(engine)
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient("https://api.github.com") as gh_http_client, httpx.AsyncClient("https://challenges.cloudflare.com") as cf_http_client:
             yield {
-                "http_client": client,
+                "gh_http_client": gh_http_client,
+                "cf_http_client": cf_http_client,
                 "db": session_maker,
             }
     finally:

server/middleware/turnstile.py

@@ -4,6 +4,7 @@
 from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
 from starlette.requests import Request
 from starlette.responses import Response
+import httpx
 
 from server.config import CONFIG
 from server.logger import logger
@@ -32,16 +33,17 @@ async def dispatch(
 
         client = request.state.http_client
         response = await client.post(
-            "https://challenges.cloudflare.com/turnstile/v0/siteverify/",
+            "/turnstile/v0/siteverify/",
             timeout=5,
             data={
                 "secret": CONFIG.turnstile_secret,  # Our secret
                 "response": token,  # Came from the client
             },
         )
 
-        data = response.json()
         try:
+            response.raise_for_status()
+            data = response.json()
             challenge_ts = datetime.fromisoformat(data["challenge_ts"]).replace(tzinfo=None)
         except (KeyError, ValueError):
             logger.debug("Invalid turnstile token (challenge_ts)")
@@ -54,6 +56,19 @@ async def dispatch(
                 data=data,
             )
             return await call_next(request)
+        except httpx.HTTPStatusError as e:
+            logger.exception(
+                "Error validating turnstile token: %s", e.response.text, exc_info=e
+            )
+            request.state.turnstile_outcome = TurnstileOutcome(
+                success=False,
+                challenge_ts=None,
+                error_codes=[e.response.text],
+                hostname=None,
+                action=None,
+                data=None,
+            )
+            return await call_next(request)
 
         request.state.turnstile_outcome = TurnstileOutcome(
             success=data["success"],

server/routes/room.py

@@ -351,8 +351,8 @@ async def trigger_deployment(request: fastapi.Request):
             detail="Missing GitHub config, cannot trigger deployment",
         )
     logger.info("Triggering deployment")
-    url = f"https://api.github.com/repos/{CONFIG.github_repo}/actions/workflows/{CONFIG.github_workflow_id}/dispatches"
-    client = cast(httpx.AsyncClient, request.state.http_client)
+    url = f"/repos/{CONFIG.github_repo}/actions/workflows/{CONFIG.github_workflow_id}/dispatches"
+    client = cast(httpx.AsyncClient, request.state.gh_http_client)
     response = await client.post(
         url=url,
         headers={