@actuate-media/cms-admin 0.80.0 → 0.80.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @actuate-media/cms-admin
 
+## 0.80.1
+
+### Patch Changes
+
+- 2f2fe29: First-class CAPTCHA policy on public form submit: enforce toggle, fail-open/closed on provider outage with timeout + audit logging, and Settings → Security status card (#676).
+
 ## 0.80.0
 
 ### Minor Changes

package/dist/views/settings/CaptchaStatusCard.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Read-only CAPTCHA status for Settings → Security (#676).
+ * Keys and policy are env / actuate.config driven — this surface shows what
+ * public form submit will enforce.
+ */
+export declare function CaptchaStatusCard(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=CaptchaStatusCard.d.ts.map

package/dist/views/settings/CaptchaStatusCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaptchaStatusCard.d.ts","sourceRoot":"","sources":["../../../src/views/settings/CaptchaStatusCard.tsx"],"names":[],"mappings":"AA2BA;;;;GAIG;AACH,wBAAgB,iBAAiB,4CAsFhC"}

package/dist/views/settings/CaptchaStatusCard.js

@@ -0,0 +1,49 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+import { ShieldCheck } from 'lucide-react';
+import { cmsApi } from '../../lib/api.js';
+import { SettingsCard } from './components.js';
+function providerLabel(provider) {
+    switch (provider) {
+        case 'turnstile':
+            return 'Cloudflare Turnstile';
+        case 'recaptcha':
+            return 'Google reCAPTCHA v3';
+        default:
+            return 'Not configured';
+    }
+}
+/**
+ * Read-only CAPTCHA status for Settings → Security (#676).
+ * Keys and policy are env / actuate.config driven — this surface shows what
+ * public form submit will enforce.
+ */
+export function CaptchaStatusCard() {
+    const [config, setConfig] = useState(null);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        let cancelled = false;
+        void cmsApi('/captcha/config')
+            .then((res) => {
+            if (cancelled)
+                return;
+            if (res.error || !res.data) {
+                setError(res.error ?? 'Unable to load captcha config');
+                return;
+            }
+            setConfig(res.data);
+        })
+            .catch((err) => {
+            if (!cancelled)
+                setError(err instanceof Error ? err.message : 'Unable to load captcha config');
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+    return (_jsx("div", { id: "security-captcha", children: _jsx(SettingsCard, { title: "Form CAPTCHA", description: "Server-side Turnstile / reCAPTCHA verification on public form submit. Provider keys stay in environment variables.", children: error ? (_jsx("p", { className: "text-destructive text-sm", children: error })) : !config ? (_jsx("p", { className: "text-muted-foreground text-sm", children: "Loading captcha status\u2026" })) : (_jsxs("div", { className: "space-y-3 text-sm", children: [_jsxs("div", { className: "flex items-start gap-2", children: [_jsx(ShieldCheck, { size: 16, className: "text-muted-foreground mt-0.5 shrink-0", "aria-hidden": true }), _jsxs("div", { className: "space-y-1", children: [_jsx("p", { className: "text-foreground font-medium", children: providerLabel(config.provider) }), _jsx("p", { className: "text-muted-foreground", children: config.provider === 'none'
+                                            ? 'Set TURNSTILE_* or RECAPTCHA_* env vars to enable. Honeypot spam protection still runs without captcha.'
+                                            : `Site key configured${config.siteKey ? ` (${config.siteKey.slice(0, 8)}…)` : ''}.` })] })] }), _jsxs("dl", { className: "border-border grid gap-2 rounded-md border p-3 sm:grid-cols-2", children: [_jsxs("div", { children: [_jsx("dt", { className: "text-muted-foreground", children: "Enforce on submit" }), _jsx("dd", { className: "text-foreground font-medium", children: config.enforce ? 'On' : 'Off' })] }), _jsxs("div", { children: [_jsx("dt", { className: "text-muted-foreground", children: "Provider outage policy" }), _jsx("dd", { className: "text-foreground font-medium", children: config.onProviderError })] }), _jsxs("div", { children: [_jsx("dt", { className: "text-muted-foreground", children: "Verify timeout" }), _jsxs("dd", { className: "text-foreground font-medium", children: [config.timeoutMs, " ms"] })] }), config.scoreThreshold != null && (_jsxs("div", { children: [_jsx("dt", { className: "text-muted-foreground", children: "reCAPTCHA score threshold" }), _jsx("dd", { className: "text-foreground font-medium", children: config.scoreThreshold })] }))] }), _jsxs("p", { className: "text-muted-foreground text-xs", children: ["Policy via ", _jsx("code", { className: "text-foreground", children: "CAPTCHA_ENFORCE" }), ",", ' ', _jsx("code", { className: "text-foreground", children: "CAPTCHA_ON_PROVIDER_ERROR" }), " (", _jsx("code", { className: "text-foreground", children: "fail-open" }), " /", ' ', _jsx("code", { className: "text-foreground", children: "fail-closed" }), "),", ' ', _jsx("code", { className: "text-foreground", children: "CAPTCHA_TIMEOUT_MS" }), ", or", ' ', _jsx("code", { className: "text-foreground", children: "forms.captcha" }), " in actuate.config. Token failures always reject when enforce is on; only provider outages follow the outage policy."] })] })) }) }));
+}
+//# sourceMappingURL=CaptchaStatusCard.js.map

package/dist/views/settings/CaptchaStatusCard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaptchaStatusCard.js","sourceRoot":"","sources":["../../../src/views/settings/CaptchaStatusCard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAW9C,SAAS,aAAa,CAAC,QAAgB;IACrC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAA;QAC/B,KAAK,WAAW;YACd,OAAO,qBAAqB,CAAA;QAC9B;YACE,OAAO,gBAAgB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA6B,IAAI,CAAC,CAAA;IACtE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,KAAK,MAAM,CAAsB,iBAAiB,CAAC;aAChD,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,CAAC,SAAS;gBACZ,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAA;QAClF,CAAC,CAAC,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,CACL,cAAK,EAAE,EAAC,kBAAkB,YACxB,KAAC,YAAY,IACX,KAAK,EAAC,cAAc,EACpB,WAAW,EAAC,oHAAoH,YAE/H,KAAK,CAAC,CAAC,CAAC,CACP,YAAG,SAAS,EAAC,0BAA0B,YAAE,KAAK,GAAK,CACpD,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CACZ,YAAG,SAAS,EAAC,+BAA+B,6CAA4B,CACzE,CAAC,CAAC,CAAC,CACF,eAAK,SAAS,EAAC,mBAAmB,aAChC,eAAK,SAAS,EAAC,wBAAwB,aACrC,KAAC,WAAW,IACV,IAAI,EAAE,EAAE,EACR,SAAS,EAAC,uCAAuC,wBAEjD,EACF,eAAK,SAAS,EAAC,WAAW,aACxB,YAAG,SAAS,EAAC,6BAA6B,YAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAK,EAC/E,YAAG,SAAS,EAAC,uBAAuB,YACjC,MAAM,CAAC,QAAQ,KAAK,MAAM;4CACzB,CAAC,CAAC,yGAAyG;4CAC3G,CAAC,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,GACpF,IACA,IACF,EACN,cAAI,SAAS,EAAC,+DAA+D,aAC3E,0BACE,aAAI,SAAS,EAAC,uBAAuB,kCAAuB,EAC5D,aAAI,SAAS,EAAC,6BAA6B,YAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAM,IAC5E,EACN,0BACE,aAAI,SAAS,EAAC,uBAAuB,uCAA4B,EACjE,aAAI,SAAS,EAAC,6BAA6B,YAAE,MAAM,CAAC,eAAe,GAAM,IACrE,EACN,0BACE,aAAI,SAAS,EAAC,uBAAuB,+BAAoB,EACzD,cAAI,SAAS,EAAC,6BAA6B,aAAE,MAAM,CAAC,SAAS,WAAS,IAClE,EACL,MAAM,CAAC,cAAc,IAAI,IAAI,IAAI,CAChC,0BACE,aAAI,SAAS,EAAC,uBAAuB,0CAA+B,EACpE,aAAI,SAAS,EAAC,6BAA6B,YAAE,MAAM,CAAC,cAAc,GAAM,IACpE,CACP,IACE,EACL,aAAG,SAAS,EAAC,+BAA+B,4BAC/B,eAAM,SAAS,EAAC,iBAAiB,gCAAuB,OAAE,GAAG,EACxE,eAAM,SAAS,EAAC,iBAAiB,0CAAiC,QAClE,eAAM,SAAS,EAAC,iBAAiB,0BAAiB,QAAG,GAAG,EACxD,eAAM,SAAS,EAAC,iBAAiB,4BAAmB,QAAG,GAAG,EAC1D,eAAM,SAAS,EAAC,iBAAiB,mCAA0B,UAAK,GAAG,EACnE,eAAM,SAAS,EAAC,iBAAiB,8BAAqB,4HAGpD,IACA,CACP,GACY,GACX,CACP,CAAA;AACH,CAAC"}

package/dist/views/settings/SecurityTab.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityTab.d.ts","sourceRoot":"","sources":["../../../src/views/settings/SecurityTab.tsx"],"names":[],"mappings":"AA8BA,wBAAgB,WAAW,CAAC,EAC1B,IAAI,EACJ,UAAU,GACX,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC,2CAoJA"}
+{"version":3,"file":"SecurityTab.d.ts","sourceRoot":"","sources":["../../../src/views/settings/SecurityTab.tsx"],"names":[],"mappings":"AA+BA,wBAAgB,WAAW,CAAC,EAC1B,IAAI,EACJ,UAAU,GACX,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC,2CAsJA"}

package/dist/views/settings/SecurityTab.js

@@ -8,6 +8,7 @@ import { AccessProtectionCard } from './AccessProtectionCard.js';
 import { AuthMfaCard } from './AuthMfaCard.js';
 import { SecretsAuditCard } from './SecretsAuditCard.js';
 import { SecurityStatusCard } from './SecurityStatusCard.js';
+import { CaptchaStatusCard } from './CaptchaStatusCard.js';
 import { SessionPolicyCard } from './SessionPolicyCard.js';
 import { useSecuritySettings } from './useSecuritySettings.js';
 function CardSkeleton() {
@@ -37,6 +38,6 @@ export function SecurityTab({ role, onNavigate, }) {
                                 ? 'Ask an administrator to review the Security tab.'
                                 : (loadError ?? 'The security service could not be reached. Try again shortly.') })] })] }));
     }
-    return (_jsxs("div", { className: "space-y-4 pb-4", children: [_jsx(SecurityStatusCard, { status: data.status, onNavigate: onNavigate }), issues.length > 0 && _jsx(SettingsValidationSummary, { issues: issues }), !canEdit && (_jsx("p", { className: "text-muted-foreground text-sm", children: "You have read-only access. Only administrators can change security settings." })), _jsx(AuthMfaCard, { form: form, setField: setField, canEdit: canEdit, viewerHasMfa: data.viewerHasMfa, withMfa: data.users.withMfa, totalAdmins: data.users.totalAdmins, onNavigate: onNavigate }), _jsx("div", { id: "security-sessions", children: _jsx(SessionPolicyCard, { form: form, setField: setField, canEdit: canEdit, activeSessions: data.activeSessions, revokeState: revokeState, onRevokeAll: () => void revokeAllOtherSessions() }) }), _jsx("div", { id: "security-ip-allowlist", children: _jsx(AccessProtectionCard, { form: form, setField: setField, canEdit: canEdit, ipAllowlist: data.ipAllowlist, secrets: data.secrets, csrfEnabled: data.csrfEnabled, uploadValidation: data.uploadValidation, sources: data.sources, onNavigate: onNavigate }) }), _jsx("div", { id: "security-audit", children: _jsx(SecretsAuditCard, { secrets: data.secrets, auditEnabled: data.auditEnabled, failedLogins24h: data.failedLogins24h, users: data.users, apiKeys: data.apiKeys, sources: data.sources, onNavigate: onNavigate }) }), saveState === 'error' && (_jsx("p", { className: "text-destructive text-sm", role: "alert", children: "Failed to save security settings. Please try again." })), _jsx(ConfirmDangerousSettingDialog, { open: lockoutPrompt !== null, title: "This allowlist may lock you out", description: lockoutPrompt ?? 'Your current IP is not covered by the allowlist you are about to save.', confirmLabel: "Save anyway", onConfirm: () => void save({ confirmLockout: true }), onCancel: dismissLockoutPrompt }), _jsx(SettingsSaveBar, { dirty: dirty, canEdit: canEdit, hasErrors: hasErrors, saveState: saveState, onSave: () => void save(), onReset: reset })] }));
+    return (_jsxs("div", { className: "space-y-4 pb-4", children: [_jsx(SecurityStatusCard, { status: data.status, onNavigate: onNavigate }), _jsx(CaptchaStatusCard, {}), issues.length > 0 && _jsx(SettingsValidationSummary, { issues: issues }), !canEdit && (_jsx("p", { className: "text-muted-foreground text-sm", children: "You have read-only access. Only administrators can change security settings." })), _jsx(AuthMfaCard, { form: form, setField: setField, canEdit: canEdit, viewerHasMfa: data.viewerHasMfa, withMfa: data.users.withMfa, totalAdmins: data.users.totalAdmins, onNavigate: onNavigate }), _jsx("div", { id: "security-sessions", children: _jsx(SessionPolicyCard, { form: form, setField: setField, canEdit: canEdit, activeSessions: data.activeSessions, revokeState: revokeState, onRevokeAll: () => void revokeAllOtherSessions() }) }), _jsx("div", { id: "security-ip-allowlist", children: _jsx(AccessProtectionCard, { form: form, setField: setField, canEdit: canEdit, ipAllowlist: data.ipAllowlist, secrets: data.secrets, csrfEnabled: data.csrfEnabled, uploadValidation: data.uploadValidation, sources: data.sources, onNavigate: onNavigate }) }), _jsx("div", { id: "security-audit", children: _jsx(SecretsAuditCard, { secrets: data.secrets, auditEnabled: data.auditEnabled, failedLogins24h: data.failedLogins24h, users: data.users, apiKeys: data.apiKeys, sources: data.sources, onNavigate: onNavigate }) }), saveState === 'error' && (_jsx("p", { className: "text-destructive text-sm", role: "alert", children: "Failed to save security settings. Please try again." })), _jsx(ConfirmDangerousSettingDialog, { open: lockoutPrompt !== null, title: "This allowlist may lock you out", description: lockoutPrompt ?? 'Your current IP is not covered by the allowlist you are about to save.', confirmLabel: "Save anyway", onConfirm: () => void save({ confirmLockout: true }), onCancel: dismissLockoutPrompt }), _jsx(SettingsSaveBar, { dirty: dirty, canEdit: canEdit, hasErrors: hasErrors, saveState: saveState, onSave: () => void save(), onReset: reset })] }));
 }
 //# sourceMappingURL=SecurityTab.js.map

package/dist/views/settings/SecurityTab.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityTab.js","sourceRoot":"","sources":["../../../src/views/settings/SecurityTab.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,6BAA6B,EAC7B,eAAe,EACf,yBAAyB,GAC1B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,SAAS,YAAY;IACnB,OAAO,CACL,eAAK,SAAS,EAAC,2DAA2D,aACxE,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,eAAK,SAAS,EAAC,WAAW,aACxB,cAAK,SAAS,EAAC,6BAA6B,GAAG,EAC/C,cAAK,SAAS,EAAC,4BAA4B,GAAG,IAC1C,IACF,CACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAC1B,IAAI,EACJ,UAAU,GAIX;IACC,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAA;IAChC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,IAAI,EACJ,KAAK,EACL,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,sBAAsB,GACvB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAEhC,gFAAgF;IAChF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM;QACpD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtE,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QACzD,EAAE,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5D,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CACL,eAAK,SAAS,EAAC,WAAW,aACxB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,IACZ,CACP,CAAA;IACH,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAC5E,OAAO,CACL,eAAK,SAAS,EAAC,kGAAkG,aAC/G,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,8BAA8B,iBAAa,MAAM,GAAG,EACrF,0BACE,YAAG,SAAS,EAAC,6BAA6B,YACvC,SAAS;gCACR,CAAC,CAAC,6CAA6C;gCAC/C,CAAC,CAAC,+BAA+B,GACjC,EACJ,YAAG,SAAS,EAAC,MAAM,YAChB,SAAS;gCACR,CAAC,CAAC,kDAAkD;gCACpD,CAAC,CAAC,CAAC,SAAS,IAAI,+DAA+D,CAAC,GAChF,IACA,IACF,CACP,CAAA;IACH,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,kBAAkB,IAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,GAAI,EAElE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAC,yBAAyB,IAAC,MAAM,EAAE,MAAM,GAAI,EAElE,CAAC,OAAO,IAAI,CACX,YAAG,SAAS,EAAC,+BAA+B,6FAExC,CACL,EAED,KAAC,WAAW,IACV,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAC3B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EACnC,UAAU,EAAE,UAAU,GACtB,EAEF,cAAK,EAAE,EAAC,mBAAmB,YACzB,KAAC,iBAAiB,IAChB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,sBAAsB,EAAE,GAChD,GACE,EAEN,cAAK,EAAE,EAAC,uBAAuB,YAC7B,KAAC,oBAAoB,IACnB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EACvC,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEN,cAAK,EAAE,EAAC,gBAAgB,YACtB,KAAC,gBAAgB,IACf,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,eAAe,EAAE,IAAI,CAAC,eAAe,EACrC,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEL,SAAS,KAAK,OAAO,IAAI,CACxB,YAAG,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,OAAO,oEAEhD,CACL,EAID,KAAC,6BAA6B,IAC5B,IAAI,EAAE,aAAa,KAAK,IAAI,EAC5B,KAAK,EAAC,iCAAiC,EACvC,WAAW,EACT,aAAa,IAAI,wEAAwE,EAE3F,YAAY,EAAC,aAAa,EAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EACpD,QAAQ,EAAE,oBAAoB,GAC9B,EAEF,KAAC,eAAe,IACd,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EACzB,OAAO,EAAE,KAAK,GACd,IACE,CACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"SecurityTab.js","sourceRoot":"","sources":["../../../src/views/settings/SecurityTab.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,6BAA6B,EAC7B,eAAe,EACf,yBAAyB,GAC1B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,SAAS,YAAY;IACnB,OAAO,CACL,eAAK,SAAS,EAAC,2DAA2D,aACxE,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,cAAK,SAAS,EAAC,gCAAgC,GAAG,EAClD,eAAK,SAAS,EAAC,WAAW,aACxB,cAAK,SAAS,EAAC,6BAA6B,GAAG,EAC/C,cAAK,SAAS,EAAC,4BAA4B,GAAG,IAC1C,IACF,CACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAC1B,IAAI,EACJ,UAAU,GAIX;IACC,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAA;IAChC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,IAAI,EACJ,KAAK,EACL,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,sBAAsB,GACvB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAEhC,gFAAgF;IAChF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM;QACpD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtE,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QACzD,EAAE,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5D,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CACL,eAAK,SAAS,EAAC,WAAW,aACxB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,EAChB,KAAC,YAAY,KAAG,IACZ,CACP,CAAA;IACH,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAC5E,OAAO,CACL,eAAK,SAAS,EAAC,kGAAkG,aAC/G,KAAC,WAAW,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,8BAA8B,iBAAa,MAAM,GAAG,EACrF,0BACE,YAAG,SAAS,EAAC,6BAA6B,YACvC,SAAS;gCACR,CAAC,CAAC,6CAA6C;gCAC/C,CAAC,CAAC,+BAA+B,GACjC,EACJ,YAAG,SAAS,EAAC,MAAM,YAChB,SAAS;gCACR,CAAC,CAAC,kDAAkD;gCACpD,CAAC,CAAC,CAAC,SAAS,IAAI,+DAA+D,CAAC,GAChF,IACA,IACF,CACP,CAAA;IACH,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,kBAAkB,IAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,GAAI,EAEnE,KAAC,iBAAiB,KAAG,EAEpB,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAC,yBAAyB,IAAC,MAAM,EAAE,MAAM,GAAI,EAElE,CAAC,OAAO,IAAI,CACX,YAAG,SAAS,EAAC,+BAA+B,6FAExC,CACL,EAED,KAAC,WAAW,IACV,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAC3B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EACnC,UAAU,EAAE,UAAU,GACtB,EAEF,cAAK,EAAE,EAAC,mBAAmB,YACzB,KAAC,iBAAiB,IAChB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,IAAI,CAAC,cAAc,EACnC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,sBAAsB,EAAE,GAChD,GACE,EAEN,cAAK,EAAE,EAAC,uBAAuB,YAC7B,KAAC,oBAAoB,IACnB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,WAAW,EAAE,IAAI,CAAC,WAAW,EAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EACvC,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEN,cAAK,EAAE,EAAC,gBAAgB,YACtB,KAAC,gBAAgB,IACf,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,eAAe,EAAE,IAAI,CAAC,eAAe,EACrC,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,UAAU,GACtB,GACE,EAEL,SAAS,KAAK,OAAO,IAAI,CACxB,YAAG,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,OAAO,oEAEhD,CACL,EAID,KAAC,6BAA6B,IAC5B,IAAI,EAAE,aAAa,KAAK,IAAI,EAC5B,KAAK,EAAC,iCAAiC,EACvC,WAAW,EACT,aAAa,IAAI,wEAAwE,EAE3F,YAAY,EAAC,aAAa,EAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EACpD,QAAQ,EAAE,oBAAoB,GAC9B,EAEF,KAAC,eAAe,IACd,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EACzB,OAAO,EAAE,KAAK,GACd,IACE,CACP,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-admin",
-  "version": "0.80.0",
+  "version": "0.80.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -98,7 +98,7 @@
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
-    "@actuate-media/cms-core": "0.102.0",
+    "@actuate-media/cms-core": "0.103.0",
     "@actuate-media/component-blocks": "0.2.2",
     "@actuate-media/plugin-ai": "0.5.6",
     "@actuate-media/plugin-blocks": "0.1.0",

package/src/views/settings/CaptchaStatusCard.tsx

@@ -0,0 +1,119 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import { ShieldCheck } from 'lucide-react'
+import { cmsApi } from '../../lib/api.js'
+import { SettingsCard } from './components.js'
+
+interface PublicCaptchaConfig {
+  provider: 'recaptcha' | 'turnstile' | 'none'
+  siteKey: string | null
+  enforce: boolean
+  onProviderError: 'fail-open' | 'fail-closed'
+  timeoutMs: number
+  scoreThreshold: number | null
+}
+
+function providerLabel(provider: string): string {
+  switch (provider) {
+    case 'turnstile':
+      return 'Cloudflare Turnstile'
+    case 'recaptcha':
+      return 'Google reCAPTCHA v3'
+    default:
+      return 'Not configured'
+  }
+}
+
+/**
+ * Read-only CAPTCHA status for Settings → Security (#676).
+ * Keys and policy are env / actuate.config driven — this surface shows what
+ * public form submit will enforce.
+ */
+export function CaptchaStatusCard() {
+  const [config, setConfig] = useState<PublicCaptchaConfig | null>(null)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    let cancelled = false
+    void cmsApi<PublicCaptchaConfig>('/captcha/config')
+      .then((res) => {
+        if (cancelled) return
+        if (res.error || !res.data) {
+          setError(res.error ?? 'Unable to load captcha config')
+          return
+        }
+        setConfig(res.data)
+      })
+      .catch((err) => {
+        if (!cancelled)
+          setError(err instanceof Error ? err.message : 'Unable to load captcha config')
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  return (
+    <div id="security-captcha">
+      <SettingsCard
+        title="Form CAPTCHA"
+        description="Server-side Turnstile / reCAPTCHA verification on public form submit. Provider keys stay in environment variables."
+      >
+        {error ? (
+          <p className="text-destructive text-sm">{error}</p>
+        ) : !config ? (
+          <p className="text-muted-foreground text-sm">Loading captcha status…</p>
+        ) : (
+          <div className="space-y-3 text-sm">
+            <div className="flex items-start gap-2">
+              <ShieldCheck
+                size={16}
+                className="text-muted-foreground mt-0.5 shrink-0"
+                aria-hidden
+              />
+              <div className="space-y-1">
+                <p className="text-foreground font-medium">{providerLabel(config.provider)}</p>
+                <p className="text-muted-foreground">
+                  {config.provider === 'none'
+                    ? 'Set TURNSTILE_* or RECAPTCHA_* env vars to enable. Honeypot spam protection still runs without captcha.'
+                    : `Site key configured${config.siteKey ? ` (${config.siteKey.slice(0, 8)}…)` : ''}.`}
+                </p>
+              </div>
+            </div>
+            <dl className="border-border grid gap-2 rounded-md border p-3 sm:grid-cols-2">
+              <div>
+                <dt className="text-muted-foreground">Enforce on submit</dt>
+                <dd className="text-foreground font-medium">{config.enforce ? 'On' : 'Off'}</dd>
+              </div>
+              <div>
+                <dt className="text-muted-foreground">Provider outage policy</dt>
+                <dd className="text-foreground font-medium">{config.onProviderError}</dd>
+              </div>
+              <div>
+                <dt className="text-muted-foreground">Verify timeout</dt>
+                <dd className="text-foreground font-medium">{config.timeoutMs} ms</dd>
+              </div>
+              {config.scoreThreshold != null && (
+                <div>
+                  <dt className="text-muted-foreground">reCAPTCHA score threshold</dt>
+                  <dd className="text-foreground font-medium">{config.scoreThreshold}</dd>
+                </div>
+              )}
+            </dl>
+            <p className="text-muted-foreground text-xs">
+              Policy via <code className="text-foreground">CAPTCHA_ENFORCE</code>,{' '}
+              <code className="text-foreground">CAPTCHA_ON_PROVIDER_ERROR</code> (
+              <code className="text-foreground">fail-open</code> /{' '}
+              <code className="text-foreground">fail-closed</code>),{' '}
+              <code className="text-foreground">CAPTCHA_TIMEOUT_MS</code>, or{' '}
+              <code className="text-foreground">forms.captcha</code> in actuate.config. Token
+              failures always reject when enforce is on; only provider outages follow the outage
+              policy.
+            </p>
+          </div>
+        )}
+      </SettingsCard>
+    </div>
+  )
+}

package/src/views/settings/SecurityTab.tsx

@@ -12,6 +12,7 @@ import { AccessProtectionCard } from './AccessProtectionCard.js'
 import { AuthMfaCard } from './AuthMfaCard.js'
 import { SecretsAuditCard } from './SecretsAuditCard.js'
 import { SecurityStatusCard } from './SecurityStatusCard.js'
+import { CaptchaStatusCard } from './CaptchaStatusCard.js'
 import { SessionPolicyCard } from './SessionPolicyCard.js'
 import { useSecuritySettings } from './useSecuritySettings.js'
 
@@ -98,6 +99,8 @@ export function SecurityTab({
     <div className="space-y-4 pb-4">
       <SecurityStatusCard status={data.status} onNavigate={onNavigate} />
 
+      <CaptchaStatusCard />
+
       {issues.length > 0 && <SettingsValidationSummary issues={issues} />}
 
       {!canEdit && (