feat: integrate Cloudflare Turnstile for enhanced security in sign-up and email verification processes. Implement rate limiting for sign-up attempts and add Turnstile validation to prevent abuse. Update environment configuration to support Turnstile keys and enhance user experience with improved error handling and feedback.

.gitignore

@@ -9,6 +9,7 @@ references
 # Build outputs
 dist
 build
+blog
 *.tsbuildinfo
 
 # Environment variables

apps/server/.env.example

@@ -31,3 +31,5 @@ SMTP_FROM=
 # PLATFORM_AI_API_KEY=
 # PLATFORM_AI_BASE_URL=
 # PLATFORM_AI_MODEL=
+
+CLOUDFLARE_TURNSTILE_SECRET_KEY=

apps/server/.gitignore

@@ -53,3 +53,5 @@ lerna-debug.log*
 # typescript
 *.tsbuildinfo
 next-env.d.ts
+
+audio-cache/

apps/server/src/index.ts

@@ -1,6 +1,7 @@
 import { trpcServer } from "@hono/trpc-server";
 import { createContext } from "@labas/api/context";
 import { appRouter } from "@labas/api/routers/index";
+import { checkRateLimitAllowed } from "@labas/api/lib/rate-limit";
 import { auth } from "@labas/auth";
 import { env } from "@labas/env/server";
 import { withRequestId } from "@labas/api/logger";
@@ -44,6 +45,21 @@ app.use(
   }),
 );
 
+// Rate limit sign-up attempts per IP to mitigate mass account creation
+app.use("/api/auth/sign-up/email", async (c, next) => {
+  if (c.req.method !== "POST") return next();
+  const cfIp = c.req.header("cf-connecting-ip");
+  const forwarded = c.req.header("x-forwarded-for");
+  const realIp = c.req.header("x-real-ip");
+  const firstForwardedIp = forwarded ? forwarded.split(",")[0]?.trim() : undefined;
+  const ip = cfIp ?? firstForwardedIp ?? realIp ?? "unknown";
+  const allowed = await checkRateLimitAllowed({ key: `signup:ip:${ip}`, limit: 5, windowMs: 3_600_000 });
+  if (!allowed) {
+    return c.json({ error: "Too many sign-up attempts. Please try again later." }, 429);
+  }
+  return next();
+});
+
 app.on(["POST", "GET"], "/api/auth/*", (c) => auth.handler(c.req.raw));
 
 app.use(

apps/web/.env.example

@@ -1,3 +1,3 @@
 VITE_SERVER_URL=http://localhost:3000
 VITE_SITE_URL=http://localhost:5173
-
+VITE_CLOUDFLARE_TURNSTILE_SITE_KEY=

apps/web/package.json

@@ -22,6 +22,7 @@
     "@labas/auth": "workspace:*",
     "@labas/env": "workspace:*",
     "@labas/ui": "workspace:*",
+    "@marsidev/react-turnstile": "^1.5.2",
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-form": "^1.28.0",
     "@tanstack/react-query": "^5.90.12",

apps/web/src/components/TurnstileField.tsx

@@ -0,0 +1,30 @@
+import { Turnstile, type TurnstileInstance, type TurnstileProps } from "@marsidev/react-turnstile";
+import { forwardRef } from "react";
+import { env } from "@labas/env/web";
+
+export const TURNSTILE_SITE_KEY = env.VITE_CLOUDFLARE_TURNSTILE_SITE_KEY;
+
+type TurnstileFieldProps = Omit<TurnstileProps, "siteKey"> & {
+  siteKey?: string;
+};
+
+export const TurnstileField = forwardRef<TurnstileInstance, TurnstileFieldProps>(
+  function TurnstileField({ options, className, siteKey, ...props }, ref) {
+    const resolvedSiteKey = siteKey ?? TURNSTILE_SITE_KEY;
+    if (!resolvedSiteKey) return null;
+
+    return (
+      <div className="w-full">
+        <div className="flex w-full items-center justify-center overflow-hidden rounded-[var(--radius-lg)] border border-[var(--oat-border)] bg-muted/40 px-2 py-2.5">
+          <Turnstile
+            ref={ref}
+            siteKey={resolvedSiteKey}
+            className={className ?? "w-full min-h-[65px] [&>iframe]:mx-auto"}
+            options={{ theme: "auto", size: "flexible", ...options }}
+            {...props}
+          />
+        </div>
+      </div>
+    );
+  },
+);

apps/web/src/components/sign-up-form.tsx

@@ -7,11 +7,14 @@ import { useMutation } from "@tanstack/react-query";
 import { useNavigate } from "@tanstack/react-router";
 import { toast } from "sonner";
 import z from "zod";
+import type { TurnstileInstance } from "@marsidev/react-turnstile";
+import { useRef, useState } from "react";
 
 import { authClient } from "@/lib/auth-client";
 import { trpc } from "@/utils/trpc";
 import { trackUmamiEvent, AnalyticsEvent } from "@/lib/umami";
 import { PasswordInput } from "@/components/ui/PasswordInput";
+import { TurnstileField, TURNSTILE_SITE_KEY } from "@/components/TurnstileField";
 
 import Loader from "./loader";
 
@@ -40,6 +43,8 @@ export default function SignUpForm({ onSwitchToSignIn }: { onSwitchToSignIn: ()
   });
   const { isPending } = authClient.useSession();
   const sendOtpMutation = useMutation(trpc.verification.sendVerificationOtp.mutationOptions());
+  const [turnstileToken, setTurnstileToken] = useState<string | undefined>(undefined);
+  const turnstileRef = useRef<TurnstileInstance>(null);
 
   const form = useForm({
     defaultValues: {
@@ -59,8 +64,10 @@ export default function SignUpForm({ onSwitchToSignIn }: { onSwitchToSignIn: ()
           onSuccess: async () => {
             trackUmamiEvent(AnalyticsEvent.SIGN_UP);
             try {
-              await sendOtpMutation.mutateAsync({ email: value.email });
+              await sendOtpMutation.mutateAsync({ email: value.email, turnstileToken });
             } catch {}
+            turnstileRef.current?.reset();
+            setTurnstileToken(undefined);
             navigate({
               to: "/verify-email",
               search: { email: value.email },
@@ -68,6 +75,8 @@ export default function SignUpForm({ onSwitchToSignIn }: { onSwitchToSignIn: ()
             toast.success("Akun berhasil dibuat! Cek email Anda untuk kode verifikasi.");
           },
           onError: (error) => {
+            turnstileRef.current?.reset();
+            setTurnstileToken(undefined);
             toast.error(error.error.message || error.error.statusText);
           },
         },
@@ -190,11 +199,22 @@ export default function SignUpForm({ onSwitchToSignIn }: { onSwitchToSignIn: ()
             </form.Field>
           </div>
 
+          <TurnstileField
+            ref={turnstileRef}
+            onSuccess={setTurnstileToken}
+            onExpire={() => setTurnstileToken(undefined)}
+            onError={() => setTurnstileToken(undefined)}
+          />
+
           <form.Subscribe
             selector={(state) => ({ canSubmit: state.canSubmit, isSubmitting: state.isSubmitting })}
           >
             {({ canSubmit, isSubmitting }) => (
-              <Button type="submit" className="w-full rounded-[var(--radius-lg)]" disabled={!canSubmit || isSubmitting}>
+              <Button
+                type="submit"
+                className="w-full rounded-[var(--radius-lg)]"
+                disabled={!canSubmit || isSubmitting || (!!TURNSTILE_SITE_KEY && !turnstileToken)}
+              >
                 {isSubmitting ? "Submitting..." : "Sign Up"}
               </Button>
             )}

apps/web/src/routes/verify-email.tsx

@@ -5,10 +5,12 @@ import { Button } from "@labas/ui/components/button";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@labas/ui/components/card";
 import { Input } from "@labas/ui/components/input";
 import { toast } from "sonner";
+import type { TurnstileInstance } from "@marsidev/react-turnstile";
 import { getErrorMessage } from "@/lib/error-utils";
 import { authClient } from "@/lib/auth-client";
 import { trpc } from "@/utils/trpc";
 import { routeShell } from "@/lib/route-shell";
+import { TurnstileField, TURNSTILE_SITE_KEY } from "@/components/TurnstileField";
 import { z } from "zod";
 
 const searchSchema = z.object({
@@ -40,6 +42,8 @@ function RouteComponent() {
 
   const sendMutation = useMutation(trpc.verification.sendVerificationOtp.mutationOptions());
   const verifyMutation = useMutation(trpc.verification.verifyEmailOtp.mutationOptions());
+  const [resendTurnstileToken, setResendTurnstileToken] = useState<string | undefined>(undefined);
+  const resendTurnstileRef = useRef<TurnstileInstance>(null);
 
   useEffect(() => {
     if (!searchEmail) {
@@ -66,13 +70,17 @@ function RouteComponent() {
     inputRefs.current[0]?.focus();
   }, []);
 
-  const handleSendOtp = async () => {
+  const handleSendOtp = async (token?: string) => {
     if (!email) return;
     try {
-      await sendMutation.mutateAsync({ email });
+      await sendMutation.mutateAsync({ email, turnstileToken: token });
       toast.success("Kode OTP telah dikirim ke email Anda");
       setCountdown(60);
+      resendTurnstileRef.current?.reset();
+      setResendTurnstileToken(undefined);
     } catch (err: unknown) {
+      resendTurnstileRef.current?.reset();
+      setResendTurnstileToken(undefined);
       toast.error(getErrorMessage(err) || "Gagal mengirim OTP");
     }
   };
@@ -173,16 +181,42 @@ function RouteComponent() {
             {verifyMutation.isPending ? "Memverifikasi..." : "Verifikasi Email"}
           </Button>
 
-          <div className="text-center text-sm text-muted-foreground">
-            Tidak menerima kode?{" "}
-            <Button
-              variant="link"
-              className="p-0 h-auto font-semibold"
-              disabled={sendMutation.isPending || countdown > 0}
-              onClick={handleSendOtp}
-            >
-              {countdown > 0 ? `Kirim ulang (${countdown}s)` : "Kirim Ulang"}
-            </Button>
+          <div className="space-y-3">
+            {countdown === 0 && TURNSTILE_SITE_KEY ? (
+              <div className="space-y-2">
+                <p className="text-center text-xs text-muted-foreground">
+                  Verifikasi keamanan untuk kirim ulang kode
+                </p>
+                <TurnstileField
+                  ref={resendTurnstileRef}
+                  onSuccess={(token) => {
+                    setResendTurnstileToken(token);
+                    handleSendOtp(token);
+                  }}
+                  onExpire={() => setResendTurnstileToken(undefined)}
+                  onError={() => setResendTurnstileToken(undefined)}
+                />
+              </div>
+            ) : null}
+            <p className="text-center text-sm text-muted-foreground">
+              Tidak menerima kode?{" "}
+              {countdown > 0 ? (
+                <span className="font-semibold text-foreground">Kirim ulang ({countdown}s)</span>
+              ) : TURNSTILE_SITE_KEY ? (
+                <span className="font-semibold text-foreground">
+                  {sendMutation.isPending ? "Mengirim..." : "Selesaikan verifikasi di atas"}
+                </span>
+              ) : (
+                <Button
+                  variant="link"
+                  className="p-0 h-auto font-semibold"
+                  disabled={sendMutation.isPending}
+                  onClick={() => handleSendOtp()}
+                >
+                  {sendMutation.isPending ? "Mengirim..." : "Kirim Ulang"}
+                </Button>
+              )}
+            </p>
           </div>
 
           <div className="text-center">

bun.lock

@@ -50,6 +50,7 @@
         "@labas/auth": "workspace:*",
         "@labas/env": "workspace:*",
         "@labas/ui": "workspace:*",
+        "@marsidev/react-turnstile": "^1.5.2",
         "@tailwindcss/vite": "^4.2.2",
         "@tanstack/react-form": "^1.28.0",
         "@tanstack/react-query": "^5.90.12",
@@ -630,6 +631,8 @@
 
     "@labas/ui": ["@labas/ui@workspace:packages/ui"],
 
+    "@marsidev/react-turnstile": ["@marsidev/react-turnstile@1.5.2", "", { "peerDependencies": { "react": "^17.0.2 || ^18.0.0 || ^19.0", "react-dom": "^17.0.2 || ^18.0.0 || ^19.0" } }, "sha512-+3aBPxp86JzSC0ZmgyonoGoUEENcUkH3LGahXSpkV87ArvD2DzRCmPgh0FyQk6PQRmJwQJDAfwNavFsxUxMQWA=="],
+
     "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.29.0", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ=="],
 
     "@mongodb-js/saslprep": ["@mongodb-js/saslprep@1.4.9", "", { "dependencies": { "sparse-bitfield": "^3.0.3" } }, "sha512-RXSxsokhAF/4nWys8An8npsqOI33Ex1Hlzqjw2pZOO+GKtMAR2noGnUdsFiGwsaO/xXI+56mtjTmDA3JXJsvmA=="],

packages/api/src/__tests__/test-db.ts

@@ -19,7 +19,7 @@ export async function createTestDb() {
   const tables = [
     `CREATE TABLE IF NOT EXISTS "user" (id text PRIMARY KEY, name text NOT NULL, email text NOT NULL UNIQUE, email_verified boolean DEFAULT false NOT NULL, image text, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
     `CREATE TABLE IF NOT EXISTS "session" (id text PRIMARY KEY, expires_at timestamp NOT NULL, token text NOT NULL UNIQUE, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL, ip_address text, user_agent text, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE)`,
-    `CREATE TABLE IF NOT EXISTS "account" (id text PRIMARY KEY, account_id text NOT NULL, provider_id text NOT NULL, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, access_token text, refresh_token text, id_token text, access_token_expires_at timestamp, refresh_token_expires_at timestamp, scope text, password text, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "account" (id text PRIMARY KEY, account_id text NOT NULL, provider_id text NOT NULL, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, access_token text, refresh_token text, id_token text, access_token_expires_at timestamp, refresh_token_expires_at timestamp, scope text, password text, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
     `CREATE TABLE IF NOT EXISTS "verification" (id text PRIMARY KEY, identifier text NOT NULL, value text NOT NULL, expires_at timestamp NOT NULL, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
     `CREATE TABLE IF NOT EXISTS "exam_type" (id text PRIMARY KEY, name text NOT NULL, language text NOT NULL, description text)`,
     `CREATE TABLE IF NOT EXISTS "section_type" (id text PRIMARY KEY, name text NOT NULL)`,

packages/api/src/__tests__/test-setup.ts

@@ -23,7 +23,7 @@ async function initSchema(pg: PGlite) {
   const tables = [
     `CREATE TABLE IF NOT EXISTS "user" (id text PRIMARY KEY, name text NOT NULL, email text NOT NULL UNIQUE, email_verified boolean DEFAULT false NOT NULL, image text, role text DEFAULT 'user' NOT NULL, suspended boolean DEFAULT false NOT NULL, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
     `CREATE TABLE IF NOT EXISTS "session" (id text PRIMARY KEY, expires_at timestamp NOT NULL, token text NOT NULL UNIQUE, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL, ip_address text, user_agent text, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE)`,
-    `CREATE TABLE IF NOT EXISTS "account" (id text PRIMARY KEY, account_id text NOT NULL, provider_id text NOT NULL, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, access_token text, refresh_token text, id_token text, access_token_expires_at timestamp, refresh_token_expires_at timestamp, scope text, password text, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "account" (id text PRIMARY KEY, account_id text NOT NULL, provider_id text NOT NULL, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, access_token text, refresh_token text, id_token text, access_token_expires_at timestamp, refresh_token_expires_at timestamp, scope text, password text, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
     `CREATE TABLE IF NOT EXISTS "verification" (id text PRIMARY KEY, identifier text NOT NULL, value text NOT NULL, expires_at timestamp NOT NULL, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
     `CREATE TABLE IF NOT EXISTS "exam_type" (id text PRIMARY KEY, name text NOT NULL, language text NOT NULL, description text)`,
     `CREATE TABLE IF NOT EXISTS "section_type" (id text PRIMARY KEY, name text NOT NULL)`,
@@ -53,10 +53,12 @@ export async function createTestUserData() {
   const [user1] = await db.insert(schema.user).values({
     id: "user-1", name: "Test User", email: "test@test.com", role: "admin",
   }).returning();
+  if (!user1) throw new Error("Failed to seed test user 1");
 
   const [user2] = await db.insert(schema.user).values({
     id: "user-2", name: "Other User", email: "other@test.com",
   }).returning();
+  if (!user2) throw new Error("Failed to seed test user 2");
 
   await db.insert(schema.examType).values([
     { id: "IELTS", name: "IELTS", language: "English" },

packages/api/src/__tests__/verification.integration.test.ts

@@ -0,0 +1,277 @@
+import { describe, it, expect, beforeAll, afterAll, mock } from "bun:test";
+import { drizzle } from "drizzle-orm/pglite";
+import { eq } from "drizzle-orm";
+import * as schema from "../../../db/src/schema";
+import { getTestPGlite, closeTestPGlite } from "./test-setup";
+
+// ── Mocks (must be declared before dynamic imports) ──────────────────────────
+
+mock.module("@labas/env/server", () => ({
+  env: {
+    DATABASE_URL: "postgres://localhost:5432/test",
+    BETTER_AUTH_SECRET: "a".repeat(32),
+    BETTER_AUTH_URL: "http://localhost:3000",
+    CORS_ORIGIN: "http://localhost:5173",
+    API_KEY_ENCRYPTION_KEY: "z".repeat(32),
+    REDIS_URL: "redis://localhost:6379",
+    SMTP_HOST: "localhost",
+    SMTP_USER: "test",
+    SMTP_PASS: "test",
+    SMTP_FROM: "test@test.com",
+    FREE_CREDITS_ENABLED: false,
+    DEFAULT_SIGNUP_CREDIT_TOKENS: 50_000,
+    // CLOUDFLARE_TURNSTILE_SECRET_KEY intentionally omitted — Turnstile disabled
+  },
+}));
+
+const mockCheckRateLimit = mock(async () => {});
+mock.module("../lib/rate-limit", () => ({
+  checkRateLimit: mockCheckRateLimit,
+  checkRateLimitAllowed: mock(async () => true),
+}));
+
+const mockSendOtpEmail = mock(async (_opts: unknown) => {});
+mock.module("../lib/email", () => ({
+  sendOtpEmail: mockSendOtpEmail,
+}));
+
+mock.module("../lib/turnstile", () => ({
+  validateTurnstileToken: mock(async () => {}),
+}));
+
+// ── Tests ─────────────────────────────────────────────────────────────────────
+
+const TEST_IP = "203.0.113.42";
+const EMAIL_UNVERIFIED = "unverified@example.com";
+const EMAIL_VERIFIED = "verified@example.com";
+const EMAIL_NONEXISTENT = "ghost@example.com";
+
+describe("verification router", () => {
+  let db: ReturnType<typeof drizzle>;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let verificationRouter: any;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let caller: any;
+
+  beforeAll(async () => {
+    const pg = await getTestPGlite();
+    db = drizzle(pg, { schema });
+
+    mock.module("@labas/db", () => ({
+      __esModule: true,
+      ...schema,
+      db,
+    }));
+
+    const mod = await import("../routers/verification");
+    verificationRouter = mod.verificationRouter;
+    caller = verificationRouter.createCaller({ session: null, auth: null, ip: TEST_IP });
+
+    await db.insert(schema.user).values([
+      { id: "v-user-1", name: "Unverified User", email: EMAIL_UNVERIFIED, emailVerified: false },
+      { id: "v-user-2", name: "Verified User", email: EMAIL_VERIFIED, emailVerified: true },
+    ]);
+
+    // Seed account row so resetPassword can update the password hash
+    await db.insert(schema.account).values({
+      id: "v-account-1",
+      accountId: "v-user-1",
+      providerId: "credential",
+      userId: "v-user-1",
+      password: "hashed_old_password",
+    });
+  });
+
+  afterAll(async () => {
+    await closeTestPGlite();
+  });
+
+  // ── sendVerificationOtp ───────────────────────────────────────────────────
+
+  describe("sendVerificationOtp", () => {
+    it("sends email and returns generic success for unverified user", async () => {
+      mockSendOtpEmail.mockClear();
+      const result = await caller.sendVerificationOtp({ email: EMAIL_UNVERIFIED });
+      expect(result.success).toBe(true);
+      expect(mockSendOtpEmail).toHaveBeenCalledTimes(1);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const callArg = (mockSendOtpEmail.mock.calls[0] as any[])[0] as { to: string; type: string; otp: string };
+      expect(callArg.to).toBe(EMAIL_UNVERIFIED);
+      expect(callArg.type).toBe("email-verification");
+      expect(callArg.otp).toMatch(/^\d{6}$/);
+    });
+
+    it("silently returns generic response for non-existent email (no enumeration)", async () => {
+      mockSendOtpEmail.mockClear();
+      const result = await caller.sendVerificationOtp({ email: EMAIL_NONEXISTENT });
+      expect(result.success).toBe(true);
+      expect(mockSendOtpEmail).not.toHaveBeenCalled();
+    });
+
+    it("silently returns generic response for already-verified email", async () => {
+      mockSendOtpEmail.mockClear();
+      const result = await caller.sendVerificationOtp({ email: EMAIL_VERIFIED });
+      expect(result.success).toBe(true);
+      expect(mockSendOtpEmail).not.toHaveBeenCalled();
+    });
+
+    it("checks per-email and per-IP rate limits with correct keys", async () => {
+      mockCheckRateLimit.mockClear();
+      await caller.sendVerificationOtp({ email: EMAIL_UNVERIFIED });
+      const keys = mockCheckRateLimit.mock.calls.map((c: unknown[]) => (c[0] as { key: string }).key);
+      expect(keys).toContain(`otp-send:email:${EMAIL_UNVERIFIED}`);
+      expect(keys).toContain(`otp-send:ip:${TEST_IP}:email`);
+    });
+
+    it("passes strict:true to checkRateLimit", async () => {
+      mockCheckRateLimit.mockClear();
+      await caller.sendVerificationOtp({ email: EMAIL_UNVERIFIED });
+      const allStrict = mockCheckRateLimit.mock.calls.every(
+        (c: unknown[]) => (c[0] as { strict?: boolean }).strict === true,
+      );
+      expect(allStrict).toBe(true);
+    });
+  });
+
+  // ── verifyEmailOtp ────────────────────────────────────────────────────────
+
+  describe("verifyEmailOtp", () => {
+    it("verifies email and returns success with correct OTP", async () => {
+      // Seed a fresh OTP directly into the verification table
+      const otp = "123456";
+      await db.delete(schema.verification).where(
+        eq(schema.verification.identifier, `email-verification:${EMAIL_UNVERIFIED}`),
+      );
+      await db.insert(schema.verification).values({
+        id: "v-otp-1",
+        identifier: `email-verification:${EMAIL_UNVERIFIED}`,
+        value: otp,
+        expiresAt: new Date(Date.now() + 5 * 60 * 1000),
+      });
+
+      const result = await caller.verifyEmailOtp({ email: EMAIL_UNVERIFIED, otp });
+      expect(result.success).toBe(true);
+
+      // emailVerified should now be true in the DB
+      const [updated] = await db
+        .select({ emailVerified: schema.user.emailVerified })
+        .from(schema.user)
+        .where(eq(schema.user.email, EMAIL_UNVERIFIED));
+      expect(updated?.emailVerified).toBe(true);
+
+      // OTP record should be deleted after use
+      const remaining = await db
+        .select()
+        .from(schema.verification)
+        .where(eq(schema.verification.id, "v-otp-1"));
+      expect(remaining).toHaveLength(0);
+    });
+
+    it("throws BAD_REQUEST for wrong OTP", async () => {
+      await expect(
+        caller.verifyEmailOtp({ email: EMAIL_UNVERIFIED, otp: "000000" }),
+      ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+    });
+
+    it("throws BAD_REQUEST for expired OTP", async () => {
+      await db.delete(schema.verification).where(
+        eq(schema.verification.identifier, `email-verification:${EMAIL_VERIFIED}`),
+      );
+      await db.insert(schema.verification).values({
+        id: "v-otp-expired",
+        identifier: `email-verification:${EMAIL_VERIFIED}`,
+        value: "654321",
+        expiresAt: new Date(Date.now() - 1000), // already expired
+      });
+
+      await expect(
+        caller.verifyEmailOtp({ email: EMAIL_VERIFIED, otp: "654321" }),
+      ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+    });
+  });
+
+  // ── sendPasswordResetOtp ──────────────────────────────────────────────────
+
+  describe("sendPasswordResetOtp", () => {
+    it("sends reset email for registered user", async () => {
+      mockSendOtpEmail.mockClear();
+      const result = await caller.sendPasswordResetOtp({ email: EMAIL_UNVERIFIED });
+      expect(result.success).toBe(true);
+      expect(mockSendOtpEmail).toHaveBeenCalledTimes(1);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const callArg = (mockSendOtpEmail.mock.calls[0] as any[])[0] as { to: string; type: string };
+      expect(callArg.to).toBe(EMAIL_UNVERIFIED);
+      expect(callArg.type).toBe("forget-password");
+    });
+
+    it("silently returns generic response for non-existent email", async () => {
+      mockSendOtpEmail.mockClear();
+      const result = await caller.sendPasswordResetOtp({ email: EMAIL_NONEXISTENT });
+      expect(result.success).toBe(true);
+      expect(mockSendOtpEmail).not.toHaveBeenCalled();
+    });
+
+    it("checks per-email and per-IP rate limits for reset", async () => {
+      mockCheckRateLimit.mockClear();
+      await caller.sendPasswordResetOtp({ email: EMAIL_UNVERIFIED });
+      const keys = mockCheckRateLimit.mock.calls.map((c: unknown[]) => (c[0] as { key: string }).key);
+      expect(keys).toContain(`otp-send:email:${EMAIL_UNVERIFIED}`);
+      expect(keys).toContain(`otp-send:ip:${TEST_IP}:reset`);
+    });
+  });
+
+  // ── resetPassword ─────────────────────────────────────────────────────────
+
+  describe("resetPassword", () => {
+    it("resets password with valid OTP", async () => {
+      const otp = "789012";
+      await db.delete(schema.verification).where(
+        eq(schema.verification.identifier, `forget-password:${EMAIL_UNVERIFIED}`),
+      );
+      await db.insert(schema.verification).values({
+        id: "v-reset-1",
+        identifier: `forget-password:${EMAIL_UNVERIFIED}`,
+        value: otp,
+        expiresAt: new Date(Date.now() + 5 * 60 * 1000),
+      });
+
+      const result = await caller.resetPassword({
+        email: EMAIL_UNVERIFIED,
+        otp,
+        newPassword: "NewPass123",
+      });
+      expect(result.success).toBe(true);
+
+      // OTP record should be deleted
+      const remaining = await db
+        .select()
+        .from(schema.verification)
+        .where(eq(schema.verification.id, "v-reset-1"));
+      expect(remaining).toHaveLength(0);
+    });
+
+    it("throws BAD_REQUEST for invalid OTP", async () => {
+      await expect(
+        caller.resetPassword({ email: EMAIL_UNVERIFIED, otp: "000000", newPassword: "NewPass123" }),
+      ).rejects.toMatchObject({ code: "BAD_REQUEST" });
+    });
+  });
+
+  // ── rate limit propagation ─────────────────────────────────────────────────
+
+  describe("rate limit enforcement", () => {
+    it("throws TOO_MANY_REQUESTS when checkRateLimit throws", async () => {
+      const { TRPCError } = await import("@trpc/server");
+      mockCheckRateLimit.mockImplementation(async () => {
+        throw new TRPCError({ code: "TOO_MANY_REQUESTS", message: "Too many requests. Please try again later." });
+      });
+
+      await expect(
+        caller.sendVerificationOtp({ email: EMAIL_UNVERIFIED }),
+      ).rejects.toMatchObject({ code: "TOO_MANY_REQUESTS" });
+
+      // Restore no-op
+      mockCheckRateLimit.mockImplementation(async () => {});
+    });
+  });
+});

packages/api/src/context.ts

@@ -1,5 +1,6 @@
 import { auth } from "@labas/auth";
 import type { Context as HonoContext } from "hono";
+import { getClientIp } from "./lib/client-ip";
 
 export type CreateContextOptions = {
   context: HonoContext;
@@ -12,6 +13,7 @@ export async function createContext({ context }: CreateContextOptions) {
   return {
     auth: null,
     session,
+    ip: getClientIp(context),
   };
 }
 

packages/api/src/lib/client-ip.ts

@@ -0,0 +1,15 @@
+import type { Context as HonoContext } from "hono";
+
+export function getClientIp(context: HonoContext): string | undefined {
+  const headers = context.req.raw.headers;
+  const cfIp = headers.get("cf-connecting-ip");
+  if (cfIp) return cfIp.trim();
+  const forwarded = headers.get("x-forwarded-for");
+  if (forwarded) {
+    const firstIp = forwarded.split(",")[0]?.trim();
+    if (firstIp) return firstIp;
+  }
+  const realIp = headers.get("x-real-ip");
+  if (realIp) return realIp.trim();
+  return undefined;
+}

packages/api/src/lib/rate-limit.ts

@@ -39,6 +39,8 @@ export interface RateLimitConfig {
   key: string;
   limit: number;
   windowMs: number;
+  /** When true, throw a 503 if Redis is unavailable instead of silently skipping. */
+  strict?: boolean;
 }
 
 export async function checkRateLimit(config: RateLimitConfig): Promise<void> {
@@ -56,10 +58,39 @@ export async function checkRateLimit(config: RateLimitConfig): Promise<void> {
     }
   } catch (err) {
     if (err instanceof TRPCError) throw err;
+    if (config.strict) {
+      logger.error("[RATELIMIT] Redis unavailable, rejecting request (strict mode)", { error: (err as Error).message });
+      throw new TRPCError({
+        code: "INTERNAL_SERVER_ERROR",
+        message: "Service temporarily unavailable. Please try again.",
+      });
+    }
     logger.warn("[RATELIMIT] Redis unavailable, rate limit skipped", { error: (err as Error).message });
   }
 }
 
+/**
+ * Returns true if the request is allowed, false if rate-limited.
+ * Used by non-tRPC contexts (e.g. Hono middleware) where throwing TRPCError is not appropriate.
+ * Fails open (returns true) when Redis is unavailable unless `strict` is set.
+ */
+export async function checkRateLimitAllowed(config: RateLimitConfig): Promise<boolean> {
+  const r = getRedis();
+  const key = `ratelimit:${config.key}`;
+  const now = Date.now();
+  try {
+    const allowed = await r.eval(SCRIPT, 1, key, config.limit.toString(), config.windowMs.toString(), now.toString());
+    return allowed !== 0;
+  } catch (err) {
+    if (config.strict) {
+      logger.error("[RATELIMIT] Redis unavailable (strict mode)", { error: (err as Error).message });
+      return false;
+    }
+    logger.warn("[RATELIMIT] Redis unavailable, rate limit skipped", { error: (err as Error).message });
+    return true;
+  }
+}
+
 export async function checkDailyBudget(key: string, limit: number): Promise<boolean> {
   const r = getRedis();
   const now = new Date();

packages/api/src/lib/turnstile.ts

@@ -0,0 +1,34 @@
+import { TRPCError } from "@trpc/server";
+import { env } from "@labas/env/server";
+import { logger } from "@labas/api/logger";
+
+/**
+ * Validates a Cloudflare Turnstile token server-side.
+ * No-ops when CLOUDFLARE_TURNSTILE_SECRET_KEY is not configured.
+ * Throws BAD_REQUEST if the token is missing or invalid when the key is set.
+ */
+export async function validateTurnstileToken(token: string | undefined): Promise<void> {
+  const secretKey = env.CLOUDFLARE_TURNSTILE_SECRET_KEY;
+  if (!secretKey) return;
+
+  if (!token) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "CAPTCHA verification is required." });
+  }
+
+  try {
+    const res = await fetch("https://challenges.cloudflare.com/turnstile/v1/siteverify", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ secret: secretKey, response: token }),
+    });
+    const data = (await res.json()) as { success: boolean; "error-codes"?: string[] };
+    if (!data.success) {
+      logger.warn("[TURNSTILE] Token verification failed", { errorCodes: data["error-codes"] });
+      throw new TRPCError({ code: "BAD_REQUEST", message: "CAPTCHA verification failed. Please try again." });
+    }
+  } catch (err) {
+    if (err instanceof TRPCError) throw err;
+    // Fail open if the Cloudflare API is unreachable — don't block legitimate users
+    logger.error("[TURNSTILE] Siteverify request failed, skipping", { error: (err as Error).message });
+  }
+}

packages/api/src/routers/verification.ts

@@ -1,4 +1,4 @@
-import { createDb } from "@labas/db";
+import { db } from "@labas/db";
 import { verification, user, account } from "@labas/db/schema/auth";
 import { TRPCError } from "@trpc/server";
 import bcrypt from "bcryptjs";
@@ -10,6 +10,7 @@ import { sendOtpEmail } from "../lib/email";
 import { autoRefillIfEligible } from "../lib/credit";
 import { publicProcedure, router } from "../index";
 import { checkRateLimit } from "../lib/rate-limit";
+import { validateTurnstileToken } from "../lib/turnstile";
 
 const OTP_LENGTH = 6;
 const OTP_EXPIRY_MS = 5 * 60 * 1000;
@@ -24,12 +25,12 @@ function genericOtpResponse() {
 
 export const verificationRouter = router({
   sendVerificationOtp: publicProcedure
-    .input(z.object({ email: z.string().email() }))
-    .mutation(async ({ input }) => {
-      await checkRateLimit({ key: `otp-send:email:${input.email}`, limit: 3, windowMs: 300_000 });
-      await checkRateLimit({ key: `otp-send:ip:email`, limit: 20, windowMs: 900_000 });
-
-      const db = createDb();
+    .input(z.object({ email: z.string().email(), turnstileToken: z.string().optional() }))
+    .mutation(async ({ input, ctx }) => {
+      const ip = ctx.ip ?? "unknown";
+      await checkRateLimit({ key: `otp-send:email:${input.email}`, limit: 3, windowMs: 300_000, strict: true });
+      await checkRateLimit({ key: `otp-send:ip:${ip}:email`, limit: 20, windowMs: 900_000, strict: true });
+      await validateTurnstileToken(input.turnstileToken);
 
       const [existingUser] = await db
         .select({ id: user.id, emailVerified: user.emailVerified })
@@ -60,10 +61,10 @@ export const verificationRouter = router({
 
   verifyEmailOtp: publicProcedure
     .input(z.object({ email: z.string().email(), otp: z.string().length(6) }))
-    .mutation(async ({ input }) => {
-      await checkRateLimit({ key: `otp-verify:email:${input.email}`, limit: 10, windowMs: 300_000 });
-
-      const db = createDb();
+    .mutation(async ({ input, ctx }) => {
+      const ip = ctx.ip ?? "unknown";
+      await checkRateLimit({ key: `otp-verify:email:${input.email}`, limit: 10, windowMs: 300_000, strict: true });
+      await checkRateLimit({ key: `otp-verify:ip:${ip}`, limit: 30, windowMs: 300_000, strict: true });
 
       const identifier = `email-verification:${input.email}`;
       const [record] = await db
@@ -103,12 +104,12 @@ export const verificationRouter = router({
     }),
 
   sendPasswordResetOtp: publicProcedure
-    .input(z.object({ email: z.string().email() }))
-    .mutation(async ({ input }) => {
-      await checkRateLimit({ key: `otp-send:email:${input.email}`, limit: 3, windowMs: 300_000 });
-      await checkRateLimit({ key: `otp-send:ip:reset`, limit: 20, windowMs: 900_000 });
-
-      const db = createDb();
+    .input(z.object({ email: z.string().email(), turnstileToken: z.string().optional() }))
+    .mutation(async ({ input, ctx }) => {
+      const ip = ctx.ip ?? "unknown";
+      await checkRateLimit({ key: `otp-send:email:${input.email}`, limit: 3, windowMs: 300_000, strict: true });
+      await checkRateLimit({ key: `otp-send:ip:${ip}:reset`, limit: 20, windowMs: 900_000, strict: true });
+      await validateTurnstileToken(input.turnstileToken);
 
       const [existingUser] = await db
         .select({ id: user.id })
@@ -145,10 +146,10 @@ export const verificationRouter = router({
         newPassword: z.string().regex(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/, "Password must be at least 8 characters with uppercase, lowercase, and number"),
       }),
     )
-    .mutation(async ({ input }) => {
-      await checkRateLimit({ key: `otp-reset:email:${input.email}`, limit: 5, windowMs: 300_000 });
-
-      const db = createDb();
+    .mutation(async ({ input, ctx }) => {
+      const ip = ctx.ip ?? "unknown";
+      await checkRateLimit({ key: `otp-reset:email:${input.email}`, limit: 5, windowMs: 300_000, strict: true });
+      await checkRateLimit({ key: `otp-reset:ip:${ip}`, limit: 15, windowMs: 300_000, strict: true });
 
       const identifier = `forget-password:${input.email}`;
       const [record] = await db

packages/env/src/server.ts

@@ -22,6 +22,7 @@ export const env = createEnv({
     FREE_CREDITS_ENABLED: z.coerce.boolean().default(false),
     FREE_CREDITS_MAX_POOL: z.coerce.number().positive().default(1_000_000),
     DEFAULT_SIGNUP_CREDIT_TOKENS: z.coerce.number().positive().default(50_000),
+    CLOUDFLARE_TURNSTILE_SECRET_KEY: z.string().optional(),
   },
   runtimeEnv: process.env,
   emptyStringAsUndefined: true,

packages/env/src/web.ts

@@ -6,6 +6,7 @@ export const env = createEnv({
   client: {
     VITE_SERVER_URL: z.url(),
     VITE_SITE_URL: z.url().default("http://localhost:5173"),
+    VITE_CLOUDFLARE_TURNSTILE_SITE_KEY: z.string().optional(),
   },
   runtimeEnv: (import.meta as any).env,
   emptyStringAsUndefined: true,