polish

.env.captcha

@@ -0,0 +1,35 @@
+#######################################
+# Captcha
+#######################################
+# Master switch. Must be true for any captcha to appear.
+CAPTCHA_ENABLED=false
+# Active provider: hcaptcha (default), turnstile, or cap
+CAPTCHA_DRIVER=hcaptcha
+
+# Per-surface toggles (each also requires CAPTCHA_ENABLED=true)
+CAPTCHA_ENABLED_ON_LOGIN=false
+CAPTCHA_ENABLED_ON_REGISTER=false
+CAPTCHA_ENABLED_ON_FORGOT_PASSWORD=false
+CAPTCHA_ENABLED_ON_PASSWORD_RESET=false
+CAPTCHA_ENABLED_ON_CURATED_REGISTER=false
+
+# --- hCaptcha (driver: hcaptcha) ---
+CAPTCHA_SECRET=
+CAPTCHA_SITEKEY=
+
+# --- Cloudflare Turnstile (driver: turnstile) ---
+CAPTCHA_TURNSTILE_SITEKEY=
+CAPTCHA_TURNSTILE_SECRET=
+CAPTCHA_TURNSTILE_TIMEOUT=5
+CAPTCHA_TURNSTILE_FAIL_OPEN=false
+
+# --- Cap, self-hosted proof-of-work (driver: cap) ---
+# Base URL WITHOUT the site key
+CAP_ENDPOINT=
+CAP_SITEKEY=
+CAP_SECRET=
+CAP_TOKEN_FIELD=cap-captcha-response
+CAP_TIMEOUT=5
+CAP_FAIL_OPEN=false
+# @cap.js/widget version from jsDelivr; leave "latest" to track newest stable
+CAP_WIDGET_VERSION=latest

.env.example

@@ -84,39 +84,3 @@ FILESYSTEM_CLOUD=s3
 ## Optional (WHEN_SUPPORTED (default) / WHEN_REQUIRED) https://docs.aws.amazon.com/sdkref/latest/guide/feature-dataintegrity.html
 # AWS_REQUEST_CHECKSUM_CALCULATION=WHEN_SUPPORTED
 # AWS_RESPONSE_CHECKSUM_VALIDATION=WHEN_SUPPORTED
-
-#######################################
-# Captcha
-#######################################
-# Master switch. Must be true for any captcha to appear.
-CAPTCHA_ENABLED=false
-# Active provider: hcaptcha (default), turnstile, or cap
-CAPTCHA_DRIVER=hcaptcha
-
-# Per-surface toggles (each also requires CAPTCHA_ENABLED=true)
-CAPTCHA_ENABLED_ON_LOGIN=false
-CAPTCHA_ENABLED_ON_REGISTER=false
-CAPTCHA_ENABLED_ON_FORGOT_PASSWORD=false
-CAPTCHA_ENABLED_ON_PASSWORD_RESET=false
-CAPTCHA_ENABLED_ON_CURATED_REGISTER=false
-
-# --- hCaptcha (driver: hcaptcha) ---
-CAPTCHA_SECRET=
-CAPTCHA_SITEKEY=
-
-# --- Cloudflare Turnstile (driver: turnstile) ---
-CAPTCHA_TURNSTILE_SITEKEY=
-CAPTCHA_TURNSTILE_SECRET=
-CAPTCHA_TURNSTILE_TIMEOUT=5
-CAPTCHA_TURNSTILE_FAIL_OPEN=false
-
-# --- Cap, self-hosted proof-of-work (driver: cap) ---
-# Base URL WITHOUT the site key
-CAP_ENDPOINT=
-CAP_SITEKEY=
-CAP_SECRET=
-CAP_TOKEN_FIELD=cap-captcha-response
-CAP_TIMEOUT=5
-CAP_FAIL_OPEN=false
-# @cap.js/widget version from jsDelivr; leave "latest" to track newest stable
-CAP_WIDGET_VERSION=latest

app/Services/AdminSettingsService.php

@@ -138,7 +138,7 @@ class AdminSettingsService
             'captcha_on_password_reset' => (bool) config_cache('captcha.active.password_reset'),
             'captcha_on_curated_register' => (bool) config_cache('captcha.active.curated_register'),
             'captcha_hcaptcha_secret' => self::maskSecret(config_cache('captcha.hcaptcha.secret')),
-            'captcha_hcaptcha_sitekey' => self::maskSecret(config_cache('captcha.hcaptcha.sitekey')),
+            'captcha_hcaptcha_sitekey' => config_cache('captcha.hcaptcha.sitekey'),
             'captcha_turnstile_secret' => self::maskSecret(config_cache('captcha.turnstile.secret')),
             'captcha_turnstile_sitekey' => config_cache('captcha.turnstile.sitekey'),
             'captcha_cap_endpoint' => config_cache('captcha.cap.endpoint'),

app/Services/Captcha/CaptchaManager.php

@@ -24,7 +24,9 @@ class CaptchaManager extends Manager
      */
     public function getDefaultDriver(): string
     {
-        return (string) (config_cache('captcha.driver') ?: config('captcha.driver', 'hcaptcha'));
+        $driver = config_cache('captcha.driver') ?: config('captcha.driver');
+
+        return $driver ?: 'hcaptcha';
     }
 
     public function createHcaptchaDriver(): CaptchaDriver

app/Services/ConfigCacheService.php

@@ -17,9 +17,6 @@ class ConfigCacheService
         'filesystems.disks.spaces.key',
         'filesystems.disks.spaces.secret',
         'captcha.hcaptcha.secret',
-        'captcha.hcaptcha.sitekey',
-        'captcha.secret',
-        'captcha.sitekey',
         'captcha.turnstile.secret',
         'captcha.cap.secret',
     ];
@@ -110,8 +107,6 @@ class ConfigCacheService
                     'captcha.driver',
                     'captcha.hcaptcha.secret',
                     'captcha.hcaptcha.sitekey',
-                    'captcha.secret',
-                    'captcha.sitekey',
                     'captcha.turnstile.secret',
                     'captcha.turnstile.sitekey',
                     'captcha.cap.endpoint',

tests/Feature/CaptchaAdminSettingsTest.php

@@ -71,7 +71,8 @@ class CaptchaAdminSettingsTest extends TestCase
         $this->assertStringContainsString('*', $platform['captcha_turnstile_secret']);
         $this->assertStringContainsString('*', $platform['captcha_cap_secret']);
 
-        // Public keys returned as-is (turnstile sitekey is not masked).
+        // Sitekeys are public and returned as-is (never masked) for every provider.
+        $this->assertSame('publicsitekey123', $platform['captcha_hcaptcha_sitekey']);
         $this->assertSame('0xPUBLICKEY', $platform['captcha_turnstile_sitekey']);
     }