@klauswuestefeld/jux-web 2026.2.2 → 2026.3.6

package/dist/captcha/turnstyle.d.ts

@@ -0,0 +1,11 @@
+declare global {
+    interface Window {
+        turnstile: {
+            render: (el: HTMLElement, opts: {
+                sitekey: string;
+                callback: (token: string) => void;
+            }) => void;
+        };
+    }
+}
+export declare const captchaChallenge: () => Promise<string>;

package/dist/jux/language.d.ts

@@ -1,4 +1,4 @@
-export declare const chosenLanguage: any;
+export declare let chosenLanguage: any;
 export declare const reloadWithLanguageOverride: (lang: string) => void;
 export declare const getTranslation: (k: string) => string;
 export declare const initLanguage: (translations_: any, defaultLanguage?: string) => void;

package/dist/jux-web.js

@@ -1,9 +1,22 @@
 var juxWeb = (function (exports) {
   'use strict';
 
-  let urlPrefix;
-  const setUrlPrefix = (s) => urlPrefix = s;
-  const getLocalStorageKey = (k) => urlPrefix ? `${urlPrefix}_${k}` : k;
+  let prefix;
+  const setLocalStoragePrefix = (s) => {
+      if (prefix !== undefined) {
+          throw 'prefix was already set to ' + prefix;
+      }
+      if (!s) {
+          throw 'prefix argument is ' + s + ', use empty string if you want no prefix.';
+      }
+      prefix = s;
+  };
+  const getLocalStorageKey = (k) => {
+      if (prefix === undefined)
+          setLocalStoragePrefix('');
+      return prefix.length === 0 ? k : `${prefix}_${k}`;
+  };
+  // TODO: export this to the frontEnd and use it.
   const getLocalStorageItem = (k) => localStorage.getItem(getLocalStorageKey(k));
   const setLocalStorageItem = (k, v) => localStorage.setItem(getLocalStorageKey(k), v);
   const removeLocalStorageItem = (k) => localStorage.removeItem(getLocalStorageKey(k));
@@ -16,7 +29,7 @@ var juxWeb = (function (exports) {
   };
   const OVERRIDE_KEY = 'jux.language.override';
   let translations = {};
-  const chosenLanguage = getLocalStorageItem(OVERRIDE_KEY) || getBrowserLanguage();
+  exports.chosenLanguage = getBrowserLanguage();
   const reloadWithLanguageOverride = (lang) => {
       setLocalStorageItem(OVERRIDE_KEY, lang);
       location.reload();
@@ -24,9 +37,10 @@ var juxWeb = (function (exports) {
   // @ts-ignore
   const getTranslation = (k) => translations[k] || k;
   const initLanguage = (translations_, defaultLanguage = 'en') => {
-      translations = translations_[chosenLanguage] || translations_[defaultLanguage];
+      exports.chosenLanguage = getLocalStorageItem(OVERRIDE_KEY) || getBrowserLanguage();
+      translations = translations_[exports.chosenLanguage] || translations_[defaultLanguage];
       document.title = getTranslation('title');
-      document.documentElement.lang = translations_[chosenLanguage] ? chosenLanguage : defaultLanguage;
+      document.documentElement.lang = translations_[exports.chosenLanguage] ? exports.chosenLanguage : defaultLanguage;
   };
 
   const THRESHOLD_WIDTH = 640;
@@ -443,6 +457,97 @@ var juxWeb = (function (exports) {
       return token;
   };
 
+  const createDisableBackground = () => {
+      const disableBackground = document.createElement('disable-background');
+      document.body.appendChild(disableBackground);
+      return disableBackground;
+  };
+  const reenableBela = (disableBackground) => {
+      disableBackground.remove();
+  };
+  const ensureTurnstileScript = () => new Promise((resolve, reject) => {
+      const existing = document.querySelector('script[data-turnstile-script]');
+      const onReady = () => (typeof window.turnstile !== 'undefined') ? resolve() : reject(new Error('Turnstile not available'));
+      if (existing) {
+          if (typeof window.turnstile !== 'undefined')
+              return resolve();
+          existing.addEventListener('load', onReady, { once: true });
+          existing.addEventListener('error', () => reject(new Error('Failed to load Turnstile')), { once: true });
+          return;
+      }
+      const script = document.createElement('script');
+      script.src = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit';
+      script.async = true;
+      script.defer = true;
+      script.dataset.turnstileScript = 'true';
+      script.addEventListener('load', onReady, { once: true });
+      script.addEventListener('error', () => reject(new Error('Failed to load Turnstile')), { once: true });
+      document.head.appendChild(script);
+      setTimeout(() => reject(new Error('Turnstile load timeout')), 15000);
+  });
+  let challengeInFlight = null;
+  const captchaChallenge = () => {
+      console.log('challange');
+      if (challengeInFlight)
+          return challengeInFlight;
+      challengeInFlight = new Promise((resolve, reject) => __awaiter$2(void 0, void 0, void 0, function* () {
+          const disableBackground = createDisableBackground();
+          let overlay = null;
+          const cleanup = () => {
+              try {
+                  overlay === null || overlay === void 0 ? void 0 : overlay.remove();
+              }
+              catch (_a) { }
+              try {
+                  reenableBela(disableBackground);
+              }
+              catch (_b) { }
+              challengeInFlight = null;
+          };
+          try {
+              yield ensureTurnstileScript();
+              overlay = document.createElement('captcha-overlay');
+              const container = document.createElement('turnstile-container');
+              container.id = 'cf-turnstile-container';
+              overlay.appendChild(container);
+              document.body.appendChild(overlay);
+              overlay.style.zIndex = '100';
+              overlay.style.width = '100%';
+              overlay.style.display = 'flex';
+              overlay.style.alignItems = 'center';
+              overlay.style.justifyContent = 'center';
+              window.turnstile.render(container, {
+                  sitekey: '0x4AAAAAAB1GW9W6TaEdd7vi',
+                  callback: (token) => {
+                      console.log("turnstile token", token);
+                      backendGet('validate-turnstile', { 'turnstile-token': token }, (res) => {
+                          console.log(res);
+                          const sessionToken = res === null || res === void 0 ? void 0 : res['session-token'];
+                          if (sessionToken) {
+                              try {
+                                  localStorage.setItem('session-token', String(sessionToken));
+                              }
+                              catch (_a) { }
+                          }
+                          cleanup();
+                          resolve(token);
+                      }, (err) => {
+                          cleanup();
+                          reject(err);
+                      });
+                      console.log("backendGet called");
+                  }
+              });
+          }
+          catch (e) {
+              cleanup();
+              reject(e);
+              console.error("backendGet threw", e);
+          }
+      }));
+      return challengeInFlight;
+  };
+
   const setBackendUrl = (backendUrl) => setLocalStorageItem('backend-url', backendUrl);
   //@ts-ignore
   const getBackendUrl = () => process.env.BACKEND_URL || getLocalStorageItem('backend-url');
@@ -549,7 +654,7 @@ var juxWeb = (function (exports) {
       }
   };
   const backendRequest = (url_2, ...args_2) => __awaiter$2(void 0, [url_2, ...args_2], void 0, function* (url, options = {}, onSuccess, onError, onRedirect, requestType = 'query', handleUnauthorized = defaultHandleUnauthorized, retrial = false, retrialNum = 0, extras) {
-      var _a;
+      var _a, _b;
       if (requestRunning && !retrial) { // only allow one request at a time
           setTimeout(() => backendRequest(url, options, onSuccess, onError, onRedirect, requestType, handleUnauthorized, false, retrialNum), 300);
           return;
@@ -630,6 +735,17 @@ var juxWeb = (function (exports) {
           handleUnauthorized(response);
           return;
       }
+      if (response.status === 429) {
+          try {
+              const token = yield captchaChallenge(); // shows overlay, disables background, validates, cleans up
+              return backendRequest(url, Object.assign(Object.assign({}, options), { headers: Object.assign(Object.assign({}, options.headers), { 'cf-turnstile-token': token, 'cf-session-token': (_b = localStorage.getItem('session-token')) !== null && _b !== void 0 ? _b : '' }) }), onSuccess, onError, onRedirect, requestType, handleUnauthorized, true, retrialNum, extras);
+          }
+          catch (e) {
+              onError === null || onError === void 0 ? void 0 : onError({ error: 'Captcha challenge failed', detail: e });
+              requestRunning = false;
+              return;
+          }
+      }
       try {
           let jsonResponse = {};
           try {
@@ -14825,7 +14941,7 @@ var juxWeb = (function (exports) {
       const onError = () => onAuthenticationFailure('login-failed');
       getSSOAuthorizationEndpoint(onSuccess, onError);
   };
-  const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError, backgroundImage, fetchUserBackendUrl, magicLinkRequestEndpoint, magicLinkAuthEndpoint, urlPrefix }) => {
+  const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError, backgroundImage, fetchUserBackendUrl, magicLinkRequestEndpoint, magicLinkAuthEndpoint, }) => {
       // if (startNewDemo()) {
       //   initDemo(setBackendToken, onAuthentication);
       //   return;
@@ -14835,8 +14951,9 @@ var juxWeb = (function (exports) {
       window.juxWebGlobal.fetchUserBackendUrl = fetchUserBackendUrl;
       window.juxWebGlobal.magicLinkRequestEndpoint = magicLinkRequestEndpoint;
       window.juxWebGlobal.magicLinkAuthEndpoint = magicLinkAuthEndpoint;
-      if (urlPrefix)
-          setUrlPrefix(urlPrefix);
+      const supportedLoginTypesArray = Array.isArray(supportedLoginTypes)
+          ? supportedLoginTypes
+          : [supportedLoginTypes];
       const signInToken = extractTokenFromWindowLocation('sign-in') || extractTokenFromWindowLocation('magic-link');
       if (signInToken) {
           const onOpenMagicLink = () => {
@@ -14870,9 +14987,6 @@ var juxWeb = (function (exports) {
           }));
           return;
       }
-      const supportedLoginTypesArray = Array.isArray(supportedLoginTypes)
-          ? supportedLoginTypes
-          : [supportedLoginTypes];
       displayPage(clientApp, loginPage(clientApp, backgroundImage, onUserLogin, onLoginError, supportedLoginTypesArray, handleSSOLogin, { onAuthPasswordLogin, onGoogleSignIn, onMicrosoftSignIn, handleMagicLinkRequest }));
       // validateThirdPartyCookies(initGapi, () => displayPage(Page.LOGIN));
       // checkMixpanel(() => mixpanel.track('View Login Page'));
@@ -14986,7 +15100,6 @@ var juxWeb = (function (exports) {
       element.dispatchEvent(new JuxEvent('command', 'POST', endpoint, onResult, params, onError, onRedirect));
   };
 
-  exports.chosenLanguage = chosenLanguage;
   exports.clearSession = clearSession;
   exports.command = command;
   exports.getCurrentUser = getCurrentUser;
@@ -15003,6 +15116,7 @@ var juxWeb = (function (exports) {
   exports.reloadWithLanguageOverride = reloadWithLanguageOverride;
   exports.requestMagicLink = requestMagicLink;
   exports.resetJuxWebGlobal = resetJuxWebGlobal;
+  exports.setLocalStoragePrefix = setLocalStoragePrefix;
   exports.upload = upload;
 
   Object.defineProperty(exports, '__esModule', { value: true });

package/dist/local-storage/utils.d.ts

@@ -1,4 +1,4 @@
-export declare const setUrlPrefix: (s: string) => string;
+export declare const setLocalStoragePrefix: (s: string) => void;
 export declare const getLocalStorageItem: (k: string) => string | null;
 export declare const setLocalStorageItem: (k: string, v: string) => void;
 export declare const removeLocalStorageItem: (k: string) => void;

package/dist/login/session.d.ts

@@ -7,9 +7,8 @@ interface InitSessionParams {
     fetchUserBackendUrl: any;
     magicLinkRequestEndpoint?: string;
     magicLinkAuthEndpoint?: string;
-    urlPrefix: string;
 }
-export declare const initSession: ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError, backgroundImage, fetchUserBackendUrl, magicLinkRequestEndpoint, magicLinkAuthEndpoint, urlPrefix }: InitSessionParams) => void;
+export declare const initSession: ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError, backgroundImage, fetchUserBackendUrl, magicLinkRequestEndpoint, magicLinkAuthEndpoint, }: InitSessionParams) => void;
 export declare const onMicrosoftSignIn: (onUserLogin: any) => Promise<void>;
 export declare const onGoogleSignIn: (onUserLogin: any) => void;
 export declare const onAuthPasswordLogin: (credentials: any, onUserLogin: any, onLoginError: any, onReturn: any, clientApp: HTMLElement, backgroundImg: string) => void;

package/dist/main.d.ts

@@ -7,6 +7,7 @@ export { magicLinkModal } from './login/magic-link-modal';
 export { clearSession } from './login/session-actions';
 export { command, query } from './jux/jux-event';
 export { getCurrentUser, resetJuxWebGlobal } from './jux/jux-web-global/utils';
+export { setLocalStoragePrefix } from './local-storage/utils';
 declare global {
     interface Window {
         submitCaptcha: any;

package/dist/main.esm.js

@@ -1,8 +1,21 @@
 import * as msal from '@azure/msal-browser';
 
-let urlPrefix;
-const setUrlPrefix = (s) => urlPrefix = s;
-const getLocalStorageKey = (k) => urlPrefix ? `${urlPrefix}_${k}` : k;
+let prefix;
+const setLocalStoragePrefix = (s) => {
+    if (prefix !== undefined) {
+        throw 'prefix was already set to ' + prefix;
+    }
+    if (!s) {
+        throw 'prefix argument is ' + s + ', use empty string if you want no prefix.';
+    }
+    prefix = s;
+};
+const getLocalStorageKey = (k) => {
+    if (prefix === undefined)
+        setLocalStoragePrefix('');
+    return prefix.length === 0 ? k : `${prefix}_${k}`;
+};
+// TODO: export this to the frontEnd and use it.
 const getLocalStorageItem = (k) => localStorage.getItem(getLocalStorageKey(k));
 const setLocalStorageItem = (k, v) => localStorage.setItem(getLocalStorageKey(k), v);
 const removeLocalStorageItem = (k) => localStorage.removeItem(getLocalStorageKey(k));
@@ -15,7 +28,7 @@ const getBrowserLanguage = () => {
 };
 const OVERRIDE_KEY = 'jux.language.override';
 let translations = {};
-const chosenLanguage = getLocalStorageItem(OVERRIDE_KEY) || getBrowserLanguage();
+let chosenLanguage = getBrowserLanguage();
 const reloadWithLanguageOverride = (lang) => {
     setLocalStorageItem(OVERRIDE_KEY, lang);
     location.reload();
@@ -23,6 +36,7 @@ const reloadWithLanguageOverride = (lang) => {
 // @ts-ignore
 const getTranslation = (k) => translations[k] || k;
 const initLanguage = (translations_, defaultLanguage = 'en') => {
+    chosenLanguage = getLocalStorageItem(OVERRIDE_KEY) || getBrowserLanguage();
     translations = translations_[chosenLanguage] || translations_[defaultLanguage];
     document.title = getTranslation('title');
     document.documentElement.lang = translations_[chosenLanguage] ? chosenLanguage : defaultLanguage;
@@ -442,6 +456,97 @@ const extractTokenFromWindowLocation = (tokenParam, additionalParam = '') => {
     return token;
 };
 
+const createDisableBackground = () => {
+    const disableBackground = document.createElement('disable-background');
+    document.body.appendChild(disableBackground);
+    return disableBackground;
+};
+const reenableBela = (disableBackground) => {
+    disableBackground.remove();
+};
+const ensureTurnstileScript = () => new Promise((resolve, reject) => {
+    const existing = document.querySelector('script[data-turnstile-script]');
+    const onReady = () => (typeof window.turnstile !== 'undefined') ? resolve() : reject(new Error('Turnstile not available'));
+    if (existing) {
+        if (typeof window.turnstile !== 'undefined')
+            return resolve();
+        existing.addEventListener('load', onReady, { once: true });
+        existing.addEventListener('error', () => reject(new Error('Failed to load Turnstile')), { once: true });
+        return;
+    }
+    const script = document.createElement('script');
+    script.src = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit';
+    script.async = true;
+    script.defer = true;
+    script.dataset.turnstileScript = 'true';
+    script.addEventListener('load', onReady, { once: true });
+    script.addEventListener('error', () => reject(new Error('Failed to load Turnstile')), { once: true });
+    document.head.appendChild(script);
+    setTimeout(() => reject(new Error('Turnstile load timeout')), 15000);
+});
+let challengeInFlight = null;
+const captchaChallenge = () => {
+    console.log('challange');
+    if (challengeInFlight)
+        return challengeInFlight;
+    challengeInFlight = new Promise((resolve, reject) => __awaiter(void 0, void 0, void 0, function* () {
+        const disableBackground = createDisableBackground();
+        let overlay = null;
+        const cleanup = () => {
+            try {
+                overlay === null || overlay === void 0 ? void 0 : overlay.remove();
+            }
+            catch (_a) { }
+            try {
+                reenableBela(disableBackground);
+            }
+            catch (_b) { }
+            challengeInFlight = null;
+        };
+        try {
+            yield ensureTurnstileScript();
+            overlay = document.createElement('captcha-overlay');
+            const container = document.createElement('turnstile-container');
+            container.id = 'cf-turnstile-container';
+            overlay.appendChild(container);
+            document.body.appendChild(overlay);
+            overlay.style.zIndex = '100';
+            overlay.style.width = '100%';
+            overlay.style.display = 'flex';
+            overlay.style.alignItems = 'center';
+            overlay.style.justifyContent = 'center';
+            window.turnstile.render(container, {
+                sitekey: '0x4AAAAAAB1GW9W6TaEdd7vi',
+                callback: (token) => {
+                    console.log("turnstile token", token);
+                    backendGet('validate-turnstile', { 'turnstile-token': token }, (res) => {
+                        console.log(res);
+                        const sessionToken = res === null || res === void 0 ? void 0 : res['session-token'];
+                        if (sessionToken) {
+                            try {
+                                localStorage.setItem('session-token', String(sessionToken));
+                            }
+                            catch (_a) { }
+                        }
+                        cleanup();
+                        resolve(token);
+                    }, (err) => {
+                        cleanup();
+                        reject(err);
+                    });
+                    console.log("backendGet called");
+                }
+            });
+        }
+        catch (e) {
+            cleanup();
+            reject(e);
+            console.error("backendGet threw", e);
+        }
+    }));
+    return challengeInFlight;
+};
+
 const setBackendUrl = (backendUrl) => setLocalStorageItem('backend-url', backendUrl);
 //@ts-ignore
 const getBackendUrl = () => process.env.BACKEND_URL || getLocalStorageItem('backend-url');
@@ -548,7 +653,7 @@ const uploadRequest = (url, file, onSuccess, onError, extras) => {
     }
 };
 const backendRequest = (url_2, ...args_2) => __awaiter(void 0, [url_2, ...args_2], void 0, function* (url, options = {}, onSuccess, onError, onRedirect, requestType = 'query', handleUnauthorized = defaultHandleUnauthorized, retrial = false, retrialNum = 0, extras) {
-    var _a;
+    var _a, _b;
     if (requestRunning && !retrial) { // only allow one request at a time
         setTimeout(() => backendRequest(url, options, onSuccess, onError, onRedirect, requestType, handleUnauthorized, false, retrialNum), 300);
         return;
@@ -629,6 +734,17 @@ const backendRequest = (url_2, ...args_2) => __awaiter(void 0, [url_2, ...args_2
         handleUnauthorized(response);
         return;
     }
+    if (response.status === 429) {
+        try {
+            const token = yield captchaChallenge(); // shows overlay, disables background, validates, cleans up
+            return backendRequest(url, Object.assign(Object.assign({}, options), { headers: Object.assign(Object.assign({}, options.headers), { 'cf-turnstile-token': token, 'cf-session-token': (_b = localStorage.getItem('session-token')) !== null && _b !== void 0 ? _b : '' }) }), onSuccess, onError, onRedirect, requestType, handleUnauthorized, true, retrialNum, extras);
+        }
+        catch (e) {
+            onError === null || onError === void 0 ? void 0 : onError({ error: 'Captcha challenge failed', detail: e });
+            requestRunning = false;
+            return;
+        }
+    }
     try {
         let jsonResponse = {};
         try {
@@ -1505,7 +1621,7 @@ const handleSSOLogin = () => {
     const onError = () => onAuthenticationFailure('login-failed');
     getSSOAuthorizationEndpoint(onSuccess, onError);
 };
-const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError, backgroundImage, fetchUserBackendUrl, magicLinkRequestEndpoint, magicLinkAuthEndpoint, urlPrefix }) => {
+const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError, backgroundImage, fetchUserBackendUrl, magicLinkRequestEndpoint, magicLinkAuthEndpoint, }) => {
     // if (startNewDemo()) {
     //   initDemo(setBackendToken, onAuthentication);
     //   return;
@@ -1515,8 +1631,9 @@ const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError
     window.juxWebGlobal.fetchUserBackendUrl = fetchUserBackendUrl;
     window.juxWebGlobal.magicLinkRequestEndpoint = magicLinkRequestEndpoint;
     window.juxWebGlobal.magicLinkAuthEndpoint = magicLinkAuthEndpoint;
-    if (urlPrefix)
-        setUrlPrefix(urlPrefix);
+    const supportedLoginTypesArray = Array.isArray(supportedLoginTypes)
+        ? supportedLoginTypes
+        : [supportedLoginTypes];
     const signInToken = extractTokenFromWindowLocation('sign-in') || extractTokenFromWindowLocation('magic-link');
     if (signInToken) {
         const onOpenMagicLink = () => {
@@ -1550,9 +1667,6 @@ const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError
         }));
         return;
     }
-    const supportedLoginTypesArray = Array.isArray(supportedLoginTypes)
-        ? supportedLoginTypes
-        : [supportedLoginTypes];
     displayPage(clientApp, loginPage(clientApp, backgroundImage, onUserLogin, onLoginError, supportedLoginTypesArray, handleSSOLogin, { onAuthPasswordLogin, onGoogleSignIn, onMicrosoftSignIn, handleMagicLinkRequest }));
     // validateThirdPartyCookies(initGapi, () => displayPage(Page.LOGIN));
     // checkMixpanel(() => mixpanel.track('View Login Page'));
@@ -1666,4 +1780,4 @@ const command = (element, endpoint, onResult, params, onError, onRedirect) => {
     element.dispatchEvent(new JuxEvent('command', 'POST', endpoint, onResult, params, onError, onRedirect));
 };
 
-export { chosenLanguage, clearSession, command, getCurrentUser, getTranslation, handleJuxEvent, handleMagicLinkRequest, initLanguage, initSession, loginButton, loginPage, magicLinkModal, onMicrosoftSignIn, query, reloadWithLanguageOverride, requestMagicLink, resetJuxWebGlobal, upload };
+export { chosenLanguage, clearSession, command, getCurrentUser, getTranslation, handleJuxEvent, handleMagicLinkRequest, initLanguage, initSession, loginButton, loginPage, magicLinkModal, onMicrosoftSignIn, query, reloadWithLanguageOverride, requestMagicLink, resetJuxWebGlobal, setLocalStoragePrefix, upload };

package/dist/main.js

@@ -24,9 +24,22 @@ function _interopNamespace(e) {
 
 var msal__namespace = /*#__PURE__*/_interopNamespace(msal);
 
-let urlPrefix;
-const setUrlPrefix = (s) => urlPrefix = s;
-const getLocalStorageKey = (k) => urlPrefix ? `${urlPrefix}_${k}` : k;
+let prefix;
+const setLocalStoragePrefix = (s) => {
+    if (prefix !== undefined) {
+        throw 'prefix was already set to ' + prefix;
+    }
+    if (!s) {
+        throw 'prefix argument is ' + s + ', use empty string if you want no prefix.';
+    }
+    prefix = s;
+};
+const getLocalStorageKey = (k) => {
+    if (prefix === undefined)
+        setLocalStoragePrefix('');
+    return prefix.length === 0 ? k : `${prefix}_${k}`;
+};
+// TODO: export this to the frontEnd and use it.
 const getLocalStorageItem = (k) => localStorage.getItem(getLocalStorageKey(k));
 const setLocalStorageItem = (k, v) => localStorage.setItem(getLocalStorageKey(k), v);
 const removeLocalStorageItem = (k) => localStorage.removeItem(getLocalStorageKey(k));
@@ -39,7 +52,7 @@ const getBrowserLanguage = () => {
 };
 const OVERRIDE_KEY = 'jux.language.override';
 let translations = {};
-const chosenLanguage = getLocalStorageItem(OVERRIDE_KEY) || getBrowserLanguage();
+exports.chosenLanguage = getBrowserLanguage();
 const reloadWithLanguageOverride = (lang) => {
     setLocalStorageItem(OVERRIDE_KEY, lang);
     location.reload();
@@ -47,9 +60,10 @@ const reloadWithLanguageOverride = (lang) => {
 // @ts-ignore
 const getTranslation = (k) => translations[k] || k;
 const initLanguage = (translations_, defaultLanguage = 'en') => {
-    translations = translations_[chosenLanguage] || translations_[defaultLanguage];
+    exports.chosenLanguage = getLocalStorageItem(OVERRIDE_KEY) || getBrowserLanguage();
+    translations = translations_[exports.chosenLanguage] || translations_[defaultLanguage];
     document.title = getTranslation('title');
-    document.documentElement.lang = translations_[chosenLanguage] ? chosenLanguage : defaultLanguage;
+    document.documentElement.lang = translations_[exports.chosenLanguage] ? exports.chosenLanguage : defaultLanguage;
 };
 
 const THRESHOLD_WIDTH = 640;
@@ -466,6 +480,97 @@ const extractTokenFromWindowLocation = (tokenParam, additionalParam = '') => {
     return token;
 };
 
+const createDisableBackground = () => {
+    const disableBackground = document.createElement('disable-background');
+    document.body.appendChild(disableBackground);
+    return disableBackground;
+};
+const reenableBela = (disableBackground) => {
+    disableBackground.remove();
+};
+const ensureTurnstileScript = () => new Promise((resolve, reject) => {
+    const existing = document.querySelector('script[data-turnstile-script]');
+    const onReady = () => (typeof window.turnstile !== 'undefined') ? resolve() : reject(new Error('Turnstile not available'));
+    if (existing) {
+        if (typeof window.turnstile !== 'undefined')
+            return resolve();
+        existing.addEventListener('load', onReady, { once: true });
+        existing.addEventListener('error', () => reject(new Error('Failed to load Turnstile')), { once: true });
+        return;
+    }
+    const script = document.createElement('script');
+    script.src = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit';
+    script.async = true;
+    script.defer = true;
+    script.dataset.turnstileScript = 'true';
+    script.addEventListener('load', onReady, { once: true });
+    script.addEventListener('error', () => reject(new Error('Failed to load Turnstile')), { once: true });
+    document.head.appendChild(script);
+    setTimeout(() => reject(new Error('Turnstile load timeout')), 15000);
+});
+let challengeInFlight = null;
+const captchaChallenge = () => {
+    console.log('challange');
+    if (challengeInFlight)
+        return challengeInFlight;
+    challengeInFlight = new Promise((resolve, reject) => __awaiter(void 0, void 0, void 0, function* () {
+        const disableBackground = createDisableBackground();
+        let overlay = null;
+        const cleanup = () => {
+            try {
+                overlay === null || overlay === void 0 ? void 0 : overlay.remove();
+            }
+            catch (_a) { }
+            try {
+                reenableBela(disableBackground);
+            }
+            catch (_b) { }
+            challengeInFlight = null;
+        };
+        try {
+            yield ensureTurnstileScript();
+            overlay = document.createElement('captcha-overlay');
+            const container = document.createElement('turnstile-container');
+            container.id = 'cf-turnstile-container';
+            overlay.appendChild(container);
+            document.body.appendChild(overlay);
+            overlay.style.zIndex = '100';
+            overlay.style.width = '100%';
+            overlay.style.display = 'flex';
+            overlay.style.alignItems = 'center';
+            overlay.style.justifyContent = 'center';
+            window.turnstile.render(container, {
+                sitekey: '0x4AAAAAAB1GW9W6TaEdd7vi',
+                callback: (token) => {
+                    console.log("turnstile token", token);
+                    backendGet('validate-turnstile', { 'turnstile-token': token }, (res) => {
+                        console.log(res);
+                        const sessionToken = res === null || res === void 0 ? void 0 : res['session-token'];
+                        if (sessionToken) {
+                            try {
+                                localStorage.setItem('session-token', String(sessionToken));
+                            }
+                            catch (_a) { }
+                        }
+                        cleanup();
+                        resolve(token);
+                    }, (err) => {
+                        cleanup();
+                        reject(err);
+                    });
+                    console.log("backendGet called");
+                }
+            });
+        }
+        catch (e) {
+            cleanup();
+            reject(e);
+            console.error("backendGet threw", e);
+        }
+    }));
+    return challengeInFlight;
+};
+
 const setBackendUrl = (backendUrl) => setLocalStorageItem('backend-url', backendUrl);
 //@ts-ignore
 const getBackendUrl = () => process.env.BACKEND_URL || getLocalStorageItem('backend-url');
@@ -572,7 +677,7 @@ const uploadRequest = (url, file, onSuccess, onError, extras) => {
     }
 };
 const backendRequest = (url_2, ...args_2) => __awaiter(void 0, [url_2, ...args_2], void 0, function* (url, options = {}, onSuccess, onError, onRedirect, requestType = 'query', handleUnauthorized = defaultHandleUnauthorized, retrial = false, retrialNum = 0, extras) {
-    var _a;
+    var _a, _b;
     if (requestRunning && !retrial) { // only allow one request at a time
         setTimeout(() => backendRequest(url, options, onSuccess, onError, onRedirect, requestType, handleUnauthorized, false, retrialNum), 300);
         return;
@@ -653,6 +758,17 @@ const backendRequest = (url_2, ...args_2) => __awaiter(void 0, [url_2, ...args_2
         handleUnauthorized(response);
         return;
     }
+    if (response.status === 429) {
+        try {
+            const token = yield captchaChallenge(); // shows overlay, disables background, validates, cleans up
+            return backendRequest(url, Object.assign(Object.assign({}, options), { headers: Object.assign(Object.assign({}, options.headers), { 'cf-turnstile-token': token, 'cf-session-token': (_b = localStorage.getItem('session-token')) !== null && _b !== void 0 ? _b : '' }) }), onSuccess, onError, onRedirect, requestType, handleUnauthorized, true, retrialNum, extras);
+        }
+        catch (e) {
+            onError === null || onError === void 0 ? void 0 : onError({ error: 'Captcha challenge failed', detail: e });
+            requestRunning = false;
+            return;
+        }
+    }
     try {
         let jsonResponse = {};
         try {
@@ -1529,7 +1645,7 @@ const handleSSOLogin = () => {
     const onError = () => onAuthenticationFailure('login-failed');
     getSSOAuthorizationEndpoint(onSuccess, onError);
 };
-const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError, backgroundImage, fetchUserBackendUrl, magicLinkRequestEndpoint, magicLinkAuthEndpoint, urlPrefix }) => {
+const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError, backgroundImage, fetchUserBackendUrl, magicLinkRequestEndpoint, magicLinkAuthEndpoint, }) => {
     // if (startNewDemo()) {
     //   initDemo(setBackendToken, onAuthentication);
     //   return;
@@ -1539,8 +1655,9 @@ const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError
     window.juxWebGlobal.fetchUserBackendUrl = fetchUserBackendUrl;
     window.juxWebGlobal.magicLinkRequestEndpoint = magicLinkRequestEndpoint;
     window.juxWebGlobal.magicLinkAuthEndpoint = magicLinkAuthEndpoint;
-    if (urlPrefix)
-        setUrlPrefix(urlPrefix);
+    const supportedLoginTypesArray = Array.isArray(supportedLoginTypes)
+        ? supportedLoginTypes
+        : [supportedLoginTypes];
     const signInToken = extractTokenFromWindowLocation('sign-in') || extractTokenFromWindowLocation('magic-link');
     if (signInToken) {
         const onOpenMagicLink = () => {
@@ -1574,9 +1691,6 @@ const initSession = ({ clientApp, supportedLoginTypes, onUserLogin, onLoginError
         }));
         return;
     }
-    const supportedLoginTypesArray = Array.isArray(supportedLoginTypes)
-        ? supportedLoginTypes
-        : [supportedLoginTypes];
     displayPage(clientApp, loginPage(clientApp, backgroundImage, onUserLogin, onLoginError, supportedLoginTypesArray, handleSSOLogin, { onAuthPasswordLogin, onGoogleSignIn, onMicrosoftSignIn, handleMagicLinkRequest }));
     // validateThirdPartyCookies(initGapi, () => displayPage(Page.LOGIN));
     // checkMixpanel(() => mixpanel.track('View Login Page'));
@@ -1690,7 +1804,6 @@ const command = (element, endpoint, onResult, params, onError, onRedirect) => {
     element.dispatchEvent(new JuxEvent('command', 'POST', endpoint, onResult, params, onError, onRedirect));
 };
 
-exports.chosenLanguage = chosenLanguage;
 exports.clearSession = clearSession;
 exports.command = command;
 exports.getCurrentUser = getCurrentUser;
@@ -1707,4 +1820,5 @@ exports.query = query;
 exports.reloadWithLanguageOverride = reloadWithLanguageOverride;
 exports.requestMagicLink = requestMagicLink;
 exports.resetJuxWebGlobal = resetJuxWebGlobal;
+exports.setLocalStoragePrefix = setLocalStoragePrefix;
 exports.upload = upload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@klauswuestefeld/jux-web",
-  "version": "2026.2.2",
+  "version": "2026.3.6",
   "author": "Jux.House",
   "license": "Copyrighted",
   "description": "",