Login flow now requires Cloudflare Turnstile verification (
8f94a38)
The /login/:service route was changed from a GET-triggered redirect to a POST that verifies a Turnstile token server-side before creating OAuth state. That closes the bypass where anyone could jump straight to /login/github, and it also switches the redirect to 303 so the browser follows up with a GET instead of reposting the form to the provider.
Other misc changes
- New captcha error types and Turnstile integration plumbing
- Frontend login form/menu updates to submit the captcha-backed POST flow
- Config, secrets, and Terraform changes to wire up Cloudflare Turnstile
- Minor route/UI adjustments related to the login flow