fix: Guard admin accounts on bypassed password reset and log bypass use

PasswordResetInitiateV2 had no privileged-account guard, so the turnstile
bypass could send admin reset mail with no captcha and no rate limit. The
lookup runs only on the bypass path and still returns the generic 200.

BypassTokenMiddleware now logs accepted and unmatched tokens, never the token.

Author: hhvrc

API/Controller/Account/PasswordResetInitiateV2.cs

@@ -5,6 +5,8 @@
 using OpenShock.API.Models.Requests;
 using OpenShock.API.Services.Turnstile;
 using OpenShock.Common.Errors;
+using OpenShock.Common.Extensions;
+using OpenShock.Common.Models;
 using OpenShock.Common.Problems;
 
 using OpenShock.Internal.Common.Problems;
@@ -37,6 +39,17 @@ public async Task<IActionResult> PasswordResetInitiateV2([FromBody] PasswordRese
         var turnstileError = await VerifyTurnstileAsync(turnstileService, body.TurnstileResponse, cancellationToken);
         if (turnstileError is not null) return turnstileError;
 
+        // Admin accounts must never be reached through a bypassed flow - the bypass exists for
+        // automated tests, not as a way to send privileged reset mail without solving Turnstile.
+        // The lookup runs only on the bypass path, so the normal path keeps its timing profile, and
+        // the response stays the generic 200 so this does not become an admin-account oracle.
+        if (HttpContext.IsBypassed(BypassTokenType.Turnstile)
+            && await _accountService.IsPrivilegedEmailAsync(body.Email, cancellationToken))
+        {
+            _logger.LogWarning("Refused a bypassed password reset for a privileged account");
+            return Ok();
+        }
+
         await _accountService.CreatePasswordResetFlowAsync(body.Email);
 
         return Ok();

API/Services/Account/AccountService.cs

@@ -157,6 +157,12 @@ public Task<bool> IsEmailRegisteredAsync(string email, CancellationToken cancell
         return _db.Users.AnyAsync(u => u.Email == email, cancellationToken);
     }
 
+    public Task<bool> IsPrivilegedEmailAsync(string email, CancellationToken cancellationToken = default)
+    {
+        email = email.ToLowerInvariant();
+        return _db.Users.AnyAsync(u => u.Email == email && u.Roles.Contains(RoleType.Admin), cancellationToken);
+    }
+
     public async Task<OneOf<Success<User>, AccountWithEmailOrUsernameExists>> CreateOAuthOnlyAccountAsync(
         string email,
         string username,

API/Services/Account/IAccountService.cs

@@ -38,6 +38,12 @@ public interface IAccountService
     /// </summary>
     Task<bool> IsEmailRegisteredAsync(string email, CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// True when the email belongs to an account holding a privileged role.
+    /// Used to keep bypassed flows away from admin accounts, not for authorization decisions.
+    /// </summary>
+    Task<bool> IsPrivilegedEmailAsync(string email, CancellationToken cancellationToken = default);
+
     /// <summary>
     /// 
     /// </summary>

Common/Middleware/BypassTokenMiddleware.cs

@@ -1,9 +1,10 @@
-using System.Security.Cryptography;
+using System.Security.Cryptography;
 using System.Text;
 using OneOf.Types;
 using OpenShock.Common.Extensions;
 using OpenShock.Common.Models;
 using OpenShock.Common.Services.Configuration;
+using Microsoft.Extensions.Logging;
 
 namespace OpenShock.Common.Middleware;
 
@@ -27,7 +28,7 @@ public BypassTokenMiddleware(RequestDelegate next)
         _next = next;
     }
 
-    public async Task InvokeAsync(HttpContext context, IConfigurationService config)
+    public async Task InvokeAsync(HttpContext context, IConfigurationService config, ILogger<BypassTokenMiddleware> logger)
     {
         if (!context.TryGetBypassTokenFromHeader(out var presented))
         {
@@ -40,7 +41,24 @@ public async Task InvokeAsync(HttpContext context, IConfigurationService config)
         if (await MatchesAsync(config, TurnstileConfigKey, presented)) matched |= BypassTokenType.Turnstile;
         if (await MatchesAsync(config, RateLimitConfigKey, presented)) matched |= BypassTokenType.RateLimit;
 
-        if (matched != BypassTokenType.None) context.SetBypassedTypes(matched);
+        if (matched != BypassTokenType.None)
+        {
+            context.SetBypassedTypes(matched);
+
+            // A credential that switches off Turnstile and rate limiting should never be used without
+            // leaving a trace. Logged at warning so it stands out in a production log, and the token
+            // itself is never written - only which protections it disabled, and for what.
+            logger.LogWarning(
+                "Bypass token accepted for {Matched} on {Method} {Path} from {RemoteIp}",
+                matched, context.Request.Method, context.Request.Path, context.Connection.RemoteIpAddress);
+        }
+        else
+        {
+            // A presented-but-unmatched token is either a stale secret or someone probing for one.
+            logger.LogWarning(
+                "Bypass token presented but matched nothing on {Method} {Path} from {RemoteIp}",
+                context.Request.Method, context.Request.Path, context.Connection.RemoteIpAddress);
+        }
 
         await _next(context);
     }