test: bypass Turnstile network calls in test env

tests/test_turnstile.py

@@ -104,7 +104,9 @@ def test_turnstile_settings_fail_loudly_without_keys_outside_dev(monkeypatch) ->
 def test_turnstile_verification_returns_false_on_transport_error(monkeypatch) -> None:
     from app.services import turnstile as turnstile_module
 
-    monkeypatch.setenv("APP_ENV", "test")
+    monkeypatch.setenv("APP_ENV", "production")
+    monkeypatch.setenv("TURNSTILE_SITE_KEY", "real-site-key")
+    monkeypatch.setenv("TURNSTILE_SECRET_KEY", "real-secret-key")
 
     def raise_error(*args, **kwargs):
         raise requests.RequestException("boom")
@@ -114,6 +116,22 @@ def test_turnstile_verification_returns_false_on_transport_error(monkeypatch) ->
     assert turnstile_module.verify_turnstile_token("token") is False
 
 
+def test_turnstile_verification_short_circuits_default_test_keys(monkeypatch) -> None:
+    from app.services import turnstile as turnstile_module
+
+    monkeypatch.setenv("APP_ENV", "test")
+    monkeypatch.setenv("TURNSTILE_SITE_KEY", turnstile_module.DEFAULT_TURNSTILE_TEST_SITE_KEY)
+    monkeypatch.setenv("TURNSTILE_SECRET_KEY", turnstile_module.DEFAULT_TURNSTILE_TEST_SECRET_KEY)
+
+    def raise_error(*args, **kwargs):
+        raise AssertionError("network should not be called for default test keys")
+
+    monkeypatch.setattr(turnstile_module.requests, "post", raise_error)
+
+    assert turnstile_module.verify_turnstile_token("token") is True
+    assert turnstile_module.verify_turnstile_token("") is False
+
+
 def test_turnstile_settings_ignore_real_credentials_in_test_environment(monkeypatch) -> None:
     from app.services import turnstile as turnstile_module