@onderwijsin/nuxt-turnstile 0.2.10 → 0.3.1

package/README.md

@@ -103,9 +103,10 @@ export default defineEventHandler(async (event) => {
 });
 ```
 
-The helper reads `x-turnstile-token` and verifies it through `@nuxtjs/turnstile`. It rejects
-missing, failed, unavailable, or mismatched-action tokens. In development, an absent secret leaves
-local forms usable; in production, it produces `TURNSTILE_SERVER_MISCONFIGURED`.
+The helper reads `x-turnstile-token` and verifies it directly with Cloudflare's Turnstile siteverify
+endpoint. It rejects missing, failed, unavailable, or mismatched-action tokens. In development, an
+absent secret leaves local forms usable; in production, it produces
+`TURNSTILE_SERVER_MISCONFIGURED`.
 
 Cloudflare's official test credentials return `metadata.result_with_testing_key: true` without an
 `action`. The helper accepts only that verified test-key response without action matching, so test
@@ -135,6 +136,9 @@ Stable error codes are `TURNSTILE_TOKEN_MISSING`, `TURNSTILE_VALIDATION_FAILED`,
 `TURNSTILE_SERVER_MISCONFIGURED`. Apply authorization and business validation in the consuming route
 after Turnstile succeeds; the module does not replace the route's existing submit or business logic.
 
+`verifyTurnstileToken` is also auto-imported for server-only use when the raw Cloudflare
+verification response is needed. Prefer `assertTurnstileToken` for protected application routes.
+
 ## Compatibility
 
 - Nuxt 4

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
   "configKey": "turnstile",
-  "version": "0.2.10",
+  "version": "0.3.1",
   "compatibility": {
     "nuxt": "^4.0.0"
   },

package/dist/module.mjs

@@ -1,9 +1,10 @@
 import { defineNuxtModule, useLogger, createResolver, addTypeTemplate, addImportsDir, addServerScanDir } from '@nuxt/kit';
 import { defu } from 'defu';
 import { enabled, resolveModuleName, resolveLoggerScope, moduleSetup, validateModuleOptions, transpileRuntime, moduleDependenciesWhenEnabled } from '@onderwijsin/nuxt-module-utils/build';
+import { isRecord, hasKey, isArray, isString } from '@onderwijsin/nuxt-module-utils/shared';
 import { z } from 'zod';
 
-const version = "0.2.10";
+const version = "0.3.1";
 
 const turnstileOptionsSchema = z.object({
   enabled,
@@ -22,6 +23,9 @@ const DEFAULTS = {
   adminToken: "",
   adminHeaderName: "x-admin-token"
 };
+function isUpstreamTurnstileVerifierPreset(preset) {
+  return isRecord(preset) && isString(preset.from) && preset.from.includes("@nuxtjs/turnstile") && isArray(preset.imports) && preset.imports.includes("verifyTurnstileToken");
+}
 const module$1 = defineNuxtModule({
   meta: {
     name: MODULE_NAME,
@@ -59,6 +63,13 @@ const module$1 = defineNuxtModule({
     );
     nuxt.options.turnstile = defu(nuxt.options.turnstile, {});
     nuxt.options.turnstile.siteKey ??= options.siteKey;
+    nuxt.hook("nitro:config", (nitro) => {
+      const imports = nitro.imports;
+      if (!isRecord(imports) || !hasKey(imports, "presets")) return;
+      const presets = imports.presets;
+      if (!isArray(presets)) return;
+      imports.presets = presets.filter((preset) => !isUpstreamTurnstileVerifierPreset(preset));
+    });
     transpileRuntime(nuxt, runtimeDir);
     addImportsDir(resolver.resolve(runtimeDir, "app", "composables"));
     addServerScanDir(resolver.resolve(runtimeDir, "server"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
-  "version": "0.2.10",
+  "version": "0.3.1",
   "description": "Nuxt Turnstile integration with client helpers and server-side validation.",
   "homepage": "https://github.com/onderwijsin/nuxt-modules#readme",
   "bugs": {