38 lines
1.3 KiB
TypeScript
38 lines
1.3 KiB
TypeScript
|
const VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify"
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Verifies a Cloudflare Turnstile token server-side against the siteverify API.
|
||
|
|
*
|
||
|
|
* Fails CLOSED when Turnstile is configured (secret present) but the token is
|
||
|
|
* missing or invalid. Fails OPEN only when `TURNSTILE_SECRET_KEY` is unset — so
|
||
|
|
* environments that haven't configured Turnstile keep working, matching how the
|
||
|
|
* other optional integrations (Stripe / OpenAI / SMTP email) degrade in this app.
|
||
|
|
*/
|
||
|
|
export async function verifyTurnstile(
|
||
|
|
token: string | undefined | null,
|
||
|
|
remoteIp?: string | null
|
||
|
|
): Promise<boolean> {
|
||
|
|
const secret = process.env.TURNSTILE_SECRET_KEY
|
||
|
|
if (!secret) return true // integration disabled — do not block auth
|
||
|
|
if (!token) return false
|
||
|
|
|
||
|
|
try {
|
||
|
|
const body = new URLSearchParams()
|
||
|
|
body.append("secret", secret)
|
||
|
|
body.append("response", token)
|
||
|
|
if (remoteIp) body.append("remoteip", remoteIp)
|
||
|
|
|
||
|
|
const res = await fetch(VERIFY_URL, {
|
||
|
|
method: "POST",
|
||
|
|
headers: { "content-type": "application/x-www-form-urlencoded" },
|
||
|
|
body,
|
||
|
|
cache: "no-store",
|
||
|
|
})
|
||
|
|
const data = (await res.json()) as { success?: boolean }
|
||
|
|
return data.success === true
|
||
|
|
} catch {
|
||
|
|
// Network / provider error — fail closed so a challenge can't be bypassed.
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
}
|