@onderwijsin/nuxt-turnstile 0.2.5 → 0.2.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -0
- package/dist/module.json +1 -1
- package/dist/module.mjs +1 -1
- package/dist/runtime/server/utils/turnstile.js +3 -2
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -107,6 +107,10 @@ The helper reads `x-turnstile-token` and verifies it through `@nuxtjs/turnstile`
|
|
|
107
107
|
missing, failed, unavailable, or mismatched-action tokens. In development, an absent secret leaves
|
|
108
108
|
local forms usable; in production, it produces `TURNSTILE_SERVER_MISCONFIGURED`.
|
|
109
109
|
|
|
110
|
+
Cloudflare's official test credentials return `metadata.result_with_testing_key: true` without an
|
|
111
|
+
`action`. The helper accepts only that verified test-key response without action matching, so test
|
|
112
|
+
credentials can exercise protected flows while normal credentials remain action-aware.
|
|
113
|
+
|
|
110
114
|
## Trusted administrator bypass
|
|
111
115
|
|
|
112
116
|
Configure `adminToken` for trusted server-to-server or administrative requests. The configured
|
package/dist/module.json
CHANGED
package/dist/module.mjs
CHANGED
|
@@ -3,7 +3,7 @@ import { defu } from 'defu';
|
|
|
3
3
|
import { enabled, resolveModuleName, resolveLoggerScope, moduleSetup, validateModuleOptions, transpileRuntime, moduleDependenciesWhenEnabled } from '@onderwijsin/nuxt-module-utils/build';
|
|
4
4
|
import { z } from 'zod';
|
|
5
5
|
|
|
6
|
-
const version = "0.2.
|
|
6
|
+
const version = "0.2.6";
|
|
7
7
|
|
|
8
8
|
const turnstileOptionsSchema = z.object({
|
|
9
9
|
enabled,
|
|
@@ -7,7 +7,8 @@ import { z } from "zod";
|
|
|
7
7
|
import { TURNSTILE_TOKEN_HEADER } from "../../constants.js";
|
|
8
8
|
const turnstileVerificationSchema = z.object({
|
|
9
9
|
success: z.boolean(),
|
|
10
|
-
action: z.string().optional()
|
|
10
|
+
action: z.string().optional(),
|
|
11
|
+
metadata: z.object({ result_with_testing_key: z.boolean().optional() }).optional()
|
|
11
12
|
});
|
|
12
13
|
export async function assertTurnstileToken(event, expectedAction) {
|
|
13
14
|
const config = useRuntimeConfig(event);
|
|
@@ -59,7 +60,7 @@ export async function assertTurnstileToken(event, expectedAction) {
|
|
|
59
60
|
"TURNSTILE_VALIDATION_FAILED",
|
|
60
61
|
expectedAction
|
|
61
62
|
);
|
|
62
|
-
if (verification.action !== expectedAction)
|
|
63
|
+
if (!verification.metadata?.result_with_testing_key && verification.action !== expectedAction)
|
|
63
64
|
throw createTurnstileError(
|
|
64
65
|
403,
|
|
65
66
|
"Turnstile action does not match",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@onderwijsin/nuxt-turnstile",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.6",
|
|
4
4
|
"description": "Nuxt Turnstile integration with client helpers and server-side validation.",
|
|
5
5
|
"homepage": "https://github.com/onderwijsin/nuxt-modules#readme",
|
|
6
6
|
"bugs": {
|
|
@@ -43,7 +43,7 @@
|
|
|
43
43
|
"defu": "6.1.7",
|
|
44
44
|
"h3": "1.15.11",
|
|
45
45
|
"zod": "4.4.3",
|
|
46
|
-
"@onderwijsin/nuxt-module-utils": "^0.3.
|
|
46
|
+
"@onderwijsin/nuxt-module-utils": "^0.3.1"
|
|
47
47
|
},
|
|
48
48
|
"devDependencies": {
|
|
49
49
|
"@nuxt/module-builder": "1.0.3",
|