@onderwijsin/nuxt-turnstile 0.2.4 → 0.2.6

package/README.md

@@ -107,6 +107,10 @@ The helper reads `x-turnstile-token` and verifies it through `@nuxtjs/turnstile`
 missing, failed, unavailable, or mismatched-action tokens. In development, an absent secret leaves
 local forms usable; in production, it produces `TURNSTILE_SERVER_MISCONFIGURED`.
 
+Cloudflare's official test credentials return `metadata.result_with_testing_key: true` without an
+`action`. The helper accepts only that verified test-key response without action matching, so test
+credentials can exercise protected flows while normal credentials remain action-aware.
+
 ## Trusted administrator bypass
 
 Configure `adminToken` for trusted server-to-server or administrative requests. The configured
@@ -137,3 +141,6 @@ after Turnstile succeeds; the module does not replace the route's existing submi
 - Node.js 22+
 - Node and Cloudflare Workers-compatible server runtime
 - No Sentry dependency or telemetry is included
+
+Developed and tested against Node.js 24 and Nuxt 4.5.x. Versions outside the current CI matrix are
+not continuously tested. Nuxt 3 is not guaranteed.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
   "configKey": "turnstile",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "compatibility": {
     "nuxt": "^4.0.0"
   },

package/dist/module.mjs

@@ -1,9 +1,9 @@
 import { defineNuxtModule, useLogger, createResolver, addTypeTemplate, addImportsDir, addServerScanDir } from '@nuxt/kit';
 import { defu } from 'defu';
-import { enabled, resolveModuleName, resolveLoggerScope, moduleSetup, validateModuleOptions, transpileRuntime, moduleDependenciesWhenEnabled } from '@onderwijsin/nuxt-module-utils/shared';
+import { enabled, resolveModuleName, resolveLoggerScope, moduleSetup, validateModuleOptions, transpileRuntime, moduleDependenciesWhenEnabled } from '@onderwijsin/nuxt-module-utils/build';
 import { z } from 'zod';
 
-const version = "0.2.4";
+const version = "0.2.6";
 
 const turnstileOptionsSchema = z.object({
   enabled,

package/dist/runtime/server/utils/turnstile.js

@@ -7,7 +7,8 @@ import { z } from "zod";
 import { TURNSTILE_TOKEN_HEADER } from "../../constants.js";
 const turnstileVerificationSchema = z.object({
   success: z.boolean(),
-  action: z.string().optional()
+  action: z.string().optional(),
+  metadata: z.object({ result_with_testing_key: z.boolean().optional() }).optional()
 });
 export async function assertTurnstileToken(event, expectedAction) {
   const config = useRuntimeConfig(event);
@@ -59,7 +60,7 @@ export async function assertTurnstileToken(event, expectedAction) {
       "TURNSTILE_VALIDATION_FAILED",
       expectedAction
     );
-  if (verification.action !== expectedAction)
+  if (!verification.metadata?.result_with_testing_key && verification.action !== expectedAction)
     throw createTurnstileError(
       403,
       "Turnstile action does not match",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Nuxt Turnstile integration with client helpers and server-side validation.",
   "homepage": "https://github.com/onderwijsin/nuxt-modules#readme",
   "bugs": {
@@ -43,7 +43,7 @@
     "defu": "6.1.7",
     "h3": "1.15.11",
     "zod": "4.4.3",
-    "@onderwijsin/nuxt-module-utils": "^0.2.0"
+    "@onderwijsin/nuxt-module-utils": "^0.3.1"
   },
   "devDependencies": {
     "@nuxt/module-builder": "1.0.3",