@marsaude/devtools-shell 0.1.1 → 0.1.3

package/fesm2022/marsaude-devtools-shell.mjs

@@ -1138,6 +1138,11 @@ class DevtoolsApiService {
         this.config = inject(DEVTOOLS_CONFIG);
         this.utils = inject(DevtoolsUtils);
         this.typeform = inject(DevtoolsTypeform);
+        // ---- reCAPTCHA (v2 Invisible) -----------------------------------------
+        /** Cached invisible-widget id: rendered once, re-executed per request. */
+        this.recaptchaWidgetId = null;
+        /** Resolver for the in-flight execute() — the widget callback fires this. */
+        this.recaptchaResolver = null;
     }
     get api() {
         return this.config.apiBaseUrl;
@@ -1296,14 +1301,43 @@ class DevtoolsApiService {
             return of([]);
         return forkJoin(valid.map((id) => this.deleteAuthStatement(id)));
     }
-    // ---- reCAPTCHA --------------------------------------------------------
     recaptcha() {
         const key = this.config.recaptchaSiteKey;
-        const grecaptcha = window.grecaptcha;
-        if (!key || !grecaptcha?.execute)
+        if (!key) {
+            console.warn('[devtools] recaptchaSiteKey not configured — request will be sent without a reCAPTCHA token');
             return of('');
-        return from(new Promise((resolve) => {
-            grecaptcha.ready(() => grecaptcha.execute(key, { action: 'login' }).then(resolve).catch(() => resolve('')));
+        }
+        return from(ensureRecaptchaScript()
+            .then((grecaptcha) => new Promise((resolve) => {
+            // v2 Invisible delivers the token via callback, not a promise.
+            // Point the shared resolver at THIS request before executing.
+            this.recaptchaResolver = (token) => {
+                this.recaptchaResolver = null;
+                try {
+                    grecaptcha.reset(this.recaptchaWidgetId);
+                }
+                catch {
+                    /* ignore */
+                }
+                resolve(token || '');
+            };
+            if (this.recaptchaWidgetId == null) {
+                const host = document.createElement('div');
+                host.style.display = 'none';
+                document.body.appendChild(host);
+                this.recaptchaWidgetId = grecaptcha.render(host, {
+                    sitekey: key,
+                    size: 'invisible',
+                    callback: (token) => this.recaptchaResolver?.(token),
+                    'error-callback': () => this.recaptchaResolver?.(''),
+                    'expired-callback': () => this.recaptchaResolver?.(''),
+                });
+            }
+            grecaptcha.execute(this.recaptchaWidgetId);
+        }))
+            .catch((e) => {
+            console.error('[devtools] failed to load reCAPTCHA', e);
+            return '';
         }));
     }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.0", ngImport: i0, type: DevtoolsApiService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
@@ -1312,6 +1346,40 @@ class DevtoolsApiService {
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.0", ngImport: i0, type: DevtoolsApiService, decorators: [{
             type: Injectable
         }] });
+const RECAPTCHA_SCRIPT_ID = 'dc-recaptcha-v2-invisible';
+/**
+ * Lazy-load the reCAPTCHA v2 (explicit render) script (once) and resolve with
+ * the `grecaptcha` API. The host only passes `recaptchaSiteKey`; the package
+ * injects the script itself so nothing depends on the host having it loaded.
+ */
+const RECAPTCHA_ONLOAD_CB = '__dcRecaptchaOnload';
+function ensureRecaptchaScript() {
+    const w = window;
+    if (w.grecaptcha?.render)
+        return Promise.resolve(w.grecaptcha);
+    return new Promise((resolve, reject) => {
+        // The script tag's own `load` event fires before grecaptcha.render is ready.
+        // The library's own `onload=` callback (passed in the URL) only fires once
+        // the API is fully initialized — that's the reliable readiness signal.
+        w[RECAPTCHA_ONLOAD_CB] = () => resolve(w.grecaptcha);
+        const existing = document.getElementById(RECAPTCHA_SCRIPT_ID);
+        if (existing) {
+            if (w.grecaptcha?.render)
+                return resolve(w.grecaptcha);
+            existing.addEventListener('error', () => reject(new Error('reCAPTCHA script failed to load')), { once: true });
+            return; // the pending onload callback above will resolve us
+        }
+        const script = document.createElement('script');
+        script.id = RECAPTCHA_SCRIPT_ID;
+        // `onload=` => library calls us when ready; `render=explicit` => we create
+        // the (invisible) widget ourselves.
+        script.src = `https://www.google.com/recaptcha/api.js?onload=${RECAPTCHA_ONLOAD_CB}&render=explicit`;
+        script.async = true;
+        script.defer = true;
+        script.onerror = () => reject(new Error('reCAPTCHA script failed to load'));
+        document.head.appendChild(script);
+    });
+}
 function onlyDigits(v) {
     return (v ?? '').replace(/\D/g, '');
 }