@next-buildr/payload 2.0.1 → 3.0.0-rc.0

package/dist/plugin/endpoints/forms.js

@@ -2,6 +2,8 @@ import { createHash } from 'node:crypto';
 import { deriveFormSchema, MAX_FORM_FIELDS } from '@next-buildr/core';
 import { resolveLayout, TEMPLATES_COLLECTION } from '../../data/resolve-layout.js';
 import { FORM_SUBMISSIONS_COLLECTION } from '../collections/form-submissions.js';
+import { ancestorFormHasCaptcha, CAPTCHA_ACTION, CAPTCHA_FIELD, captchaCData, findFormCaptchas, formSubtreeNodes, isCaptchaToken, } from '../forms/captcha.js';
+import { clientIpOf } from '../forms/client-ip.js';
 import { isAllowedRecipient } from '../forms/notify.js';
 import { validateSubmission } from '../forms/validate.js';
 import { readLayout } from '../hooks/read-layout.js';
@@ -53,9 +55,8 @@ async function readBody(req) {
     return { ok: false, response: fail(415, 'The content type must be a form or JSON.') };
 }
 /** The visitor's address, hashed with the server secret: enough to rate-limit, not to identify. */
-function ipHashOf(req) {
-    const forwarded = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim();
-    const ip = forwarded || req.headers.get('x-real-ip') || 'unknown';
+function ipHashOf(req, source) {
+    const ip = clientIpOf(req, source);
     return createHash('sha256').update(`${req.payload.secret}:${ip}`).digest('hex').slice(0, 32);
 }
 /** Back to the page the form was on (same origin only, so the redirect can never leave the site). */
@@ -101,7 +102,7 @@ export const formsEndpoint = (env) => ({
         const locale = chooseLocale(req, req.searchParams?.get('locale'));
         if (!locale.ok)
             return locale.response;
-        const ipHash = ipHashOf(req);
+        const ipHash = ipHashOf(req, env.options.forms.clientIp);
         const limited = await env.rateLimiter?.hit(`${ipHash}:${collection}:${id}:${nodeId}`);
         if (limited !== undefined && !limited.allowed) {
             const response = fail(429, 'Too many submissions. Try again later.');
@@ -119,7 +120,7 @@ export const formsEndpoint = (env) => ({
         if (trap !== undefined && !(typeof trap === 'string' && trap === '')) {
             return done('sent') ?? json({ ok: true });
         }
-        if (Object.keys(values).length > MAX_FORM_FIELDS)
+        if (Object.keys(values).filter((name) => name !== CAPTCHA_FIELD).length > MAX_FORM_FIELDS)
             return fail(422, 'Too many fields.');
         // Only the published state is public: a draft, or a document never published, has no form.
         let stored;
@@ -137,17 +138,20 @@ export const formsEndpoint = (env) => ({
         }
         if (stored['_status'] !== 'published')
             return fail(404, 'The form was not found.');
-        const layout = isTemplate
-            ? stored['layout']
-            : (await resolveLayout({
+        const resolved = isTemplate
+            ? {
+                layout: stored['layout'],
+                layoutRef: stored['id'] === undefined ? null : `${TEMPLATES_COLLECTION}:${String(stored['id'])}`,
+            }
+            : await resolveLayout({
                 payload: req.payload,
                 collection,
                 doc: stored,
                 contextName: own?.context ?? collection,
                 draft: false,
                 overrideAccess: true,
-            })).layout;
-        const read = readLayout(layout, env.options);
+            });
+        const read = readLayout(resolved.layout, env.options);
         const form = read.ok && Object.hasOwn(read.doc.nodes, nodeId) ? read.doc.nodes[nodeId] : undefined;
         if (!read.ok ||
             form === undefined ||
@@ -155,8 +159,102 @@ export const formsEndpoint = (env) => ({
             env.options.registry === undefined) {
             return fail(404, 'The form was not found.');
         }
-        const { schema } = deriveFormSchema(read.doc, env.options.registry.meta, nodeId);
-        const result = validateSubmission(schema, values);
+        const snapshot = read.doc;
+        const canonicalRef = resolved.layoutRef;
+        if (canonicalRef === null)
+            return fail(404, 'The form was not found.');
+        const captchaFailure = (unavailable) => done('invalid') ??
+            (unavailable
+                ? json({ error: 'Verification is unavailable. Try again later.', code: 'captcha-unavailable' }, 503)
+                : json({
+                    errors: { [CAPTCHA_FIELD]: 'The verification failed. Try again.' },
+                    codes: { [CAPTCHA_FIELD]: 'captcha' },
+                }, 422));
+        const configFailure = () => {
+            req.payload.logger.error({
+                msg: 'buildr: captcha configuration error',
+                reason: 'configuration',
+            });
+            return captchaFailure(true);
+        };
+        // Check raw author fields too: invalid metadata or the field limit must not mask this name.
+        const reservedName = formSubtreeNodes(snapshot, nodeId).some((node) => {
+            const field = env.options.registry?.meta.get(node.type)?.formField;
+            const name = field !== undefined && node.props !== undefined && Object.hasOwn(node.props, field.nameProp)
+                ? node.props[field.nameProp]
+                : undefined;
+            return name?.kind === 'static' && name.value === CAPTCHA_FIELD;
+        });
+        const captchas = findFormCaptchas(snapshot, nodeId);
+        if (reservedName || ancestorFormHasCaptcha(snapshot, nodeId) || captchas.length > 1)
+            return configFailure();
+        const { schema } = deriveFormSchema(snapshot, env.options.registry.meta, nodeId);
+        let submitted = values;
+        if (captchas.length === 1) {
+            const captcha = env.captcha;
+            if (captcha === undefined)
+                return configFailure();
+            const token = Object.hasOwn(values, CAPTCHA_FIELD) ? values[CAPTCHA_FIELD] : undefined;
+            if (!isCaptchaToken(token))
+                return captchaFailure(false);
+            const limited = await captcha.rateLimiter.hit(ipHash);
+            if (limited !== undefined && !limited.allowed) {
+                const response = fail(429, 'Too many submissions. Try again later.');
+                response.headers.set('retry-after', String(limited.retryAfterSeconds));
+                return response;
+            }
+            const release = captcha.gate.tryAcquire();
+            if (release === null)
+                return captchaFailure(true);
+            let verification;
+            let onAbort = () => { };
+            const signal = AbortSignal.timeout(5000);
+            try {
+                const deadline = new Promise((resolve) => {
+                    onAbort = () => {
+                        release();
+                        resolve({ ok: false, reason: 'unavailable' });
+                    };
+                    signal.addEventListener('abort', onAbort, { once: true });
+                    if (signal.aborted)
+                        onAbort();
+                });
+                verification = await Promise.race([captcha.verifier.verify({ token, signal }), deadline]);
+            }
+            catch {
+                verification = { ok: false, reason: 'unavailable' };
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+                release();
+            }
+            if (verification?.ok !== true) {
+                const unavailable = !verification ||
+                    (verification.reason !== 'invalid' && verification.reason !== 'expired-or-reused');
+                const entry = {
+                    msg: 'buildr: captcha verification',
+                    reason: unavailable ? 'unavailable' : verification.reason,
+                    ...verification?.log,
+                };
+                if (unavailable)
+                    req.payload.logger.error(entry);
+                else
+                    req.payload.logger.warn(entry);
+                return captchaFailure(unavailable);
+            }
+            if (typeof verification.hostname !== 'string' ||
+                typeof verification.action !== 'string' ||
+                typeof verification.cdata !== 'string' ||
+                !captcha.hostnames.includes(verification.hostname.toLowerCase()) ||
+                verification.action !== CAPTCHA_ACTION ||
+                verification.cdata !== captchaCData(canonicalRef, nodeId)) {
+                req.payload.logger.warn({ msg: 'buildr: captcha verification', reason: 'mismatch' });
+                return captchaFailure(false);
+            }
+            const { [CAPTCHA_FIELD]: _token, ...clean } = values;
+            submitted = clean;
+        }
+        const result = validateSubmission(schema, submitted);
         if (!result.ok) {
             if (!wantsJson)
                 return backTo(req, 'invalid');

package/dist/plugin/endpoints/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/publish.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIxC,OAAO,EAGL,KAAK,WAAW,EAOjB,MAAM,cAAc,CAAC;AAItB;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAS,WAAW,KAAG,QAiEjD,CAAC"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/publish.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKxC,OAAO,EAGL,KAAK,WAAW,EAOjB,MAAM,cAAc,CAAC;AAItB;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAS,WAAW,KAAG,QAoEjD,CAAC"}

package/dist/plugin/endpoints/publish.js

@@ -1,5 +1,6 @@
 import { runA11y } from '@next-buildr/core';
 import { publishRequestSchema, publishResponseSchema } from '../../contract.js';
+import { authorCodePermitted } from '../access.js';
 import { processLayout } from '../hooks/process-layout.js';
 import { configuredLocales } from '../locales.js';
 import { allowed, bodyOf, latestOf, revisionOf, targetOf, updatedBy, writeContext, writeLimit, } from './context.js';
@@ -38,9 +39,12 @@ export const publishEndpoint = (env) => ({
         const current = revisionOf(found.value);
         if (parsed.data.baseRevision !== current)
             return conflict(current);
+        // Publishing writes no layout: what is stored passes as it is (a save already vetted its author code).
         const layout = processLayout(found.value['layout'], {
             ...env.options,
             locales: configuredLocales(req.payload.config),
+            allowAuthorCode: await authorCodePermitted(env.options, req),
+            previous: found.value['layout'],
         });
         if (!layout.ok)
             return invalid(layout.diagnostics);

package/dist/plugin/endpoints/save.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"save.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/save.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIxC,OAAO,EAGL,KAAK,WAAW,EAOjB,MAAM,cAAc,CAAC;AAItB;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAAS,WAAW,KAAG,QA0C9C,CAAC"}
+{"version":3,"file":"save.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/save.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKxC,OAAO,EAGL,KAAK,WAAW,EAOjB,MAAM,cAAc,CAAC;AAItB;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAAS,WAAW,KAAG,QA4C9C,CAAC"}

package/dist/plugin/endpoints/save.js

@@ -1,4 +1,5 @@
 import { saveRequestSchema, saveResponseSchema } from '../../contract.js';
+import { authorCodePermitted } from '../access.js';
 import { processLayout } from '../hooks/process-layout.js';
 import { configuredLocales } from '../locales.js';
 import { allowed, bodyOf, latestOf, revisionOf, targetOf, updatedBy, writeContext, writeLimit, } from './context.js';
@@ -39,6 +40,8 @@ export const saveEndpoint = (env) => ({
         const layout = processLayout(parsed.data.document, {
             ...env.options,
             locales: configuredLocales(req.payload.config),
+            allowAuthorCode: await authorCodePermitted(env.options, req),
+            previous: found.value['layout'],
         });
         if (!layout.ok)
             return invalid(layout.diagnostics);

package/dist/plugin/forms/captcha.d.ts

@@ -0,0 +1,45 @@
+import type { BuilderDocument, PageNode } from '@next-buildr/core';
+export declare const CAPTCHA_FIELD = "buildr-captcha";
+export declare const CAPTCHA_ACTION = "buildr_form";
+export declare const CAPTCHA_TYPE = "buildr/captcha";
+export type CaptchaVerification = {
+    ok: true;
+    hostname: string;
+    action: string;
+    cdata: string;
+} | {
+    ok: false;
+    reason: 'invalid' | 'expired-or-reused' | 'unavailable';
+    log?: CaptchaLog;
+};
+export interface CaptchaVerifier {
+    verify(input: {
+        token: string;
+        signal: AbortSignal;
+    }): Promise<CaptchaVerification>;
+}
+export declare const isCaptchaToken: (token: unknown) => token is string;
+/** Shared with the widget: hash the UTF-8 JSON tuple, never a request-derived layout reference. */
+export declare function captchaCData(layoutRef: string, formNodeId: string): string;
+export interface CaptchaGate {
+    tryAcquire(): (() => void) | null;
+}
+/** Each plugin instance owns its gate. Releases are idempotent (deadline and finally may race). */
+export declare function createCaptchaGate(maxInFlight: number): CaptchaGate;
+type CaptchaLog = {
+    reason: 'configuration' | 'invalid' | 'expired-or-reused' | 'unavailable';
+    codes: readonly string[];
+};
+/** A fixed origin and bounded, abortable response reader keep secret-bearing requests contained. */
+export declare function createTurnstileVerifier(options: {
+    secretKey: string;
+    fetch?: typeof globalThis.fetch;
+    log?: (entry: CaptchaLog) => void;
+}): CaptchaVerifier;
+/** Literal graph traversal: registry metadata and render-time conditions cannot waive a challenge. */
+export declare function formSubtreeNodes(snapshot: BuilderDocument, formNodeId: string): PageNode[];
+export declare function findFormCaptchas(snapshot: BuilderDocument, formNodeId: string): PageNode[];
+/** All reverse edges count, including corrupt multiple-parent graphs; cycles cannot hide an ancestor. */
+export declare function ancestorFormHasCaptcha(snapshot: BuilderDocument, formNodeId: string): boolean;
+export {};
+//# sourceMappingURL=captcha.d.ts.map

package/dist/plugin/forms/captcha.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha.d.ts","sourceRoot":"","sources":["../../../src/plugin/forms/captcha.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGnE,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAC9C,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAC5C,eAAO,MAAM,YAAY,mBAAmB,CAAC;AAO7C,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,GAAG,aAAa,CAAC;IAAC,GAAG,CAAC,EAAE,UAAU,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACrF;AAED,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAAK,IAAI,MACM,CAAC;AAEhE,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI1E;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;CACnC;AAED,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAclE;AASD,KAAK,UAAU,GAAG;IAChB,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,mBAAmB,GAAG,aAAa,CAAC;IAC1E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC;AAGF,oGAAoG;AACpG,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;CACnC,GAAG,eAAe,CAgGlB;AAED,sGAAsG;AACtG,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,QAAQ,EAAE,CAgB1F;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,QAAQ,EAAE,CAE1F;AAED,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAsB7F"}

package/dist/plugin/forms/captcha.js

@@ -0,0 +1,195 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+export const CAPTCHA_FIELD = 'buildr-captcha';
+export const CAPTCHA_ACTION = 'buildr_form';
+export const CAPTCHA_TYPE = 'buildr/captcha';
+const FORM_TYPE = 'buildr/form';
+const SITEVERIFY = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+const TOKEN = /^[A-Za-z0-9._-]{1,2048}$/;
+const CODE = /^[a-z0-9-]{1,64}$/;
+const MAX_RESPONSE_BYTES = 16 * 1024;
+export const isCaptchaToken = (token) => typeof token === 'string' && TOKEN.exec(token)?.[0] === token;
+/** Shared with the widget: hash the UTF-8 JSON tuple, never a request-derived layout reference. */
+export function captchaCData(layoutRef, formNodeId) {
+    return createHash('sha256')
+        .update(JSON.stringify([CAPTCHA_TYPE, 1, layoutRef, formNodeId]), 'utf8')
+        .digest('hex');
+}
+/** Each plugin instance owns its gate. Releases are idempotent (deadline and finally may race). */
+export function createCaptchaGate(maxInFlight) {
+    let active = 0;
+    return {
+        tryAcquire() {
+            if (active >= maxInFlight)
+                return null;
+            active += 1;
+            let released = false;
+            return () => {
+                if (released)
+                    return;
+                released = true;
+                active -= 1;
+            };
+        },
+    };
+}
+const responseSchema = z.object({
+    success: z.boolean(),
+    'error-codes': z.array(z.string()).optional(),
+    hostname: z.string().optional(),
+    action: z.string().optional(),
+    cdata: z.string().optional(),
+});
+const unavailable = () => ({ ok: false, reason: 'unavailable' });
+/** A fixed origin and bounded, abortable response reader keep secret-bearing requests contained. */
+export function createTurnstileVerifier(options) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    return {
+        async verify({ token, signal }) {
+            if (!isCaptchaToken(token))
+                return { ok: false, reason: 'invalid' };
+            if (signal.aborted)
+                return unavailable();
+            let reader;
+            let onAbort = () => { };
+            const cancelled = new Promise((resolve) => {
+                onAbort = () => {
+                    void reader?.cancel().catch(() => { });
+                    resolve(unavailable());
+                };
+                signal.addEventListener('abort', onAbort, { once: true });
+            });
+            const run = async () => {
+                try {
+                    const response = await fetcher(SITEVERIFY, {
+                        method: 'POST',
+                        body: new URLSearchParams({ secret: options.secretKey, response: token }),
+                        redirect: 'error',
+                        cache: 'no-store',
+                        signal,
+                    });
+                    if (!response.ok || response.body === null || signal.aborted) {
+                        void response.body?.cancel().catch(() => { });
+                        return unavailable();
+                    }
+                    reader = response.body.getReader();
+                    const chunks = [];
+                    let size = 0;
+                    while (true) {
+                        const chunk = await reader.read();
+                        if (signal.aborted)
+                            return unavailable();
+                        if (chunk.done)
+                            break;
+                        size += chunk.value.byteLength;
+                        if (size > MAX_RESPONSE_BYTES) {
+                            void reader.cancel().catch(() => { });
+                            return unavailable();
+                        }
+                        chunks.push(chunk.value);
+                    }
+                    const bytes = new Uint8Array(size);
+                    let offset = 0;
+                    for (const chunk of chunks) {
+                        bytes.set(chunk, offset);
+                        offset += chunk.byteLength;
+                    }
+                    const parsed = responseSchema.safeParse(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)));
+                    if (!parsed.success)
+                        return unavailable();
+                    const body = parsed.data;
+                    if (body.success) {
+                        if (typeof body.hostname !== 'string' || typeof body.action !== 'string')
+                            return unavailable();
+                        return {
+                            ok: true,
+                            hostname: body.hostname,
+                            action: body.action,
+                            cdata: body.cdata ?? '',
+                        };
+                    }
+                    const codes = body['error-codes'] ?? [];
+                    const config = codes.includes('missing-input-secret') || codes.includes('invalid-input-secret');
+                    const reason = config || codes.includes('internal-error')
+                        ? 'unavailable'
+                        : codes.includes('timeout-or-duplicate')
+                            ? 'expired-or-reused'
+                            : 'invalid';
+                    const log = {
+                        reason: config ? 'configuration' : reason,
+                        codes: codes
+                            .filter((code) => CODE.exec(code)?.[0] === code &&
+                            !code.includes(token) &&
+                            !code.includes(options.secretKey))
+                            .slice(0, 10),
+                    };
+                    options.log?.(log);
+                    return { ok: false, reason, ...(options.log === undefined ? { log } : {}) };
+                }
+                catch {
+                    return unavailable();
+                }
+            };
+            try {
+                return await Promise.race([run(), cancelled]);
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+            }
+        },
+    };
+}
+/** Literal graph traversal: registry metadata and render-time conditions cannot waive a challenge. */
+export function formSubtreeNodes(snapshot, formNodeId) {
+    const visited = new Set();
+    const stack = [formNodeId];
+    const nodes = [];
+    while (stack.length > 0) {
+        const id = stack.pop();
+        if (id === undefined || visited.has(id))
+            continue;
+        visited.add(id);
+        const node = Object.hasOwn(snapshot.nodes, id) ? snapshot.nodes[id] : undefined;
+        if (node === undefined || (id !== formNodeId && node.type === FORM_TYPE))
+            continue;
+        if (id !== formNodeId)
+            nodes.push(node);
+        for (const children of Object.values(node.slots ?? {})) {
+            for (const child of children)
+                stack.push(child);
+        }
+    }
+    return nodes;
+}
+export function findFormCaptchas(snapshot, formNodeId) {
+    return formSubtreeNodes(snapshot, formNodeId).filter((node) => node.type === CAPTCHA_TYPE);
+}
+/** All reverse edges count, including corrupt multiple-parent graphs; cycles cannot hide an ancestor. */
+export function ancestorFormHasCaptcha(snapshot, formNodeId) {
+    const parents = new Map();
+    for (const [id, node] of Object.entries(snapshot.nodes)) {
+        for (const children of Object.values(node.slots ?? {})) {
+            for (const child of children) {
+                const list = parents.get(child);
+                if (list === undefined)
+                    parents.set(child, [id]);
+                else
+                    list.push(id);
+            }
+        }
+    }
+    const visited = new Set([formNodeId]);
+    const stack = [...(parents.get(formNodeId) ?? [])];
+    while (stack.length > 0) {
+        const id = stack.pop();
+        if (id === undefined || visited.has(id))
+            continue;
+        visited.add(id);
+        const node = Object.hasOwn(snapshot.nodes, id) ? snapshot.nodes[id] : undefined;
+        if (node?.type === FORM_TYPE && findFormCaptchas(snapshot, id).length > 0)
+            return true;
+        for (const parent of parents.get(id) ?? [])
+            stack.push(parent);
+    }
+    return false;
+}

package/dist/plugin/forms/captcha.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=captcha.test.d.ts.map

package/dist/plugin/forms/captcha.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/forms/captcha.test.ts"],"names":[],"mappings":""}