test: force Turnstile test mode in CI

.gitea/workflows/ci.yaml

@@ -56,6 +56,8 @@ jobs:
     runs-on: [linux, docker]
     container:
       image: mcr.microsoft.com/playwright:v1.58.0-noble
+    env:
+      APP_ENV: test
     steps:
       - uses: actions/checkout@v4
       - name: Set up Python

app/services/turnstile.py

@@ -33,8 +33,19 @@ def load_turnstile_settings() -> TurnstileSettings:
     enabled = os.getenv("TURNSTILE_ENABLED", "true").lower() not in {"0", "false", "no"}
     env = _environment()
 
-    if not site_key or not secret_key:
-        if env in {"development", "test"}:
+    known_test_pairs = {
+        (DEFAULT_TURNSTILE_TEST_SITE_KEY, DEFAULT_TURNSTILE_TEST_SECRET_KEY),
+        (ALWAYS_FAIL_TURNSTILE_TEST_SITE_KEY, ALWAYS_FAIL_TURNSTILE_TEST_SECRET_KEY),
+    }
+
+    if env == "test":
+        if (site_key, secret_key) not in known_test_pairs:
+            if site_key or secret_key:
+                logger.info("Ignoring configured Turnstile credentials in test environment and using test keys")
+            site_key = DEFAULT_TURNSTILE_TEST_SITE_KEY
+            secret_key = DEFAULT_TURNSTILE_TEST_SECRET_KEY
+    elif not site_key or not secret_key:
+        if env == "development":
             site_key = site_key or DEFAULT_TURNSTILE_TEST_SITE_KEY
             secret_key = secret_key or DEFAULT_TURNSTILE_TEST_SECRET_KEY
         else:

tests/test_turnstile.py

@@ -114,6 +114,21 @@ def test_turnstile_verification_returns_false_on_transport_error(monkeypatch) ->
     assert turnstile_module.verify_turnstile_token("token") is False
 
 
+def test_turnstile_settings_ignore_real_credentials_in_test_environment(monkeypatch) -> None:
+    from app.services import turnstile as turnstile_module
+
+    monkeypatch.setenv("APP_ENV", "test")
+    monkeypatch.setenv("TURNSTILE_SITE_KEY", "real-site-key")
+    monkeypatch.setenv("TURNSTILE_SECRET_KEY", "real-secret-key")
+
+    settings = turnstile_module.load_turnstile_settings()
+
+    assert settings.site_key == turnstile_module.DEFAULT_TURNSTILE_TEST_SITE_KEY
+    assert settings.secret_key == turnstile_module.DEFAULT_TURNSTILE_TEST_SECRET_KEY
+    assert settings.enabled is True
+    assert settings.uses_test_keys is True
+
+
 def test_turnstile_settings_support_always_fail_test_keys(monkeypatch) -> None:
     from app.services import turnstile as turnstile_module