@onderwijsin/nuxt-turnstile 0.2.8 → 0.2.10

package/README.md

@@ -138,7 +138,7 @@ after Turnstile succeeds; the module does not replace the route's existing submi
 ## Compatibility
 
 - Nuxt 4
-- Node.js 22+
+- Node.js 24+; Node.js 22 may work but is untested and unsupported.
 - Node and Cloudflare Workers-compatible server runtime
 - No Sentry dependency or telemetry is included
 

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
   "configKey": "turnstile",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "compatibility": {
     "nuxt": "^4.0.0"
   },

package/dist/module.mjs

@@ -3,7 +3,7 @@ import { defu } from 'defu';
 import { enabled, resolveModuleName, resolveLoggerScope, moduleSetup, validateModuleOptions, transpileRuntime, moduleDependenciesWhenEnabled } from '@onderwijsin/nuxt-module-utils/build';
 import { z } from 'zod';
 
-const version = "0.2.8";
+const version = "0.2.10";
 
 const turnstileOptionsSchema = z.object({
   enabled,
@@ -57,9 +57,7 @@ const module$1 = defineNuxtModule({
         siteKey: options.siteKey
       }
     );
-    if (!nuxt.options.turnstile) {
-      nuxt.options.turnstile = {};
-    }
+    nuxt.options.turnstile = defu(nuxt.options.turnstile, {});
     nuxt.options.turnstile.siteKey ??= options.siteKey;
     transpileRuntime(nuxt, runtimeDir);
     addImportsDir(resolver.resolve(runtimeDir, "app", "composables"));

package/dist/runtime/server/utils/turnstile.d.ts

@@ -1,5 +1,43 @@
 import type { H3Event } from "h3";
+import { z } from "zod";
 import type { TurnstileErrorCode, TurnstileErrorData } from "../../types/errors.js";
+export declare const turnstileValidationErrorCodeSchema: z.ZodEnum<{
+    "missing-input-secret": "missing-input-secret";
+    "invalid-input-secret": "invalid-input-secret";
+    "missing-input-response": "missing-input-response";
+    "invalid-input-response": "invalid-input-response";
+    "bad-request": "bad-request";
+    "timeout-or-duplicate": "timeout-or-duplicate";
+    "internal-error": "internal-error";
+}>;
+export declare const turnstileValidationResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    hostname: z.ZodString;
+    "error-codes": z.ZodArray<z.ZodEnum<{
+        "missing-input-secret": "missing-input-secret";
+        "invalid-input-secret": "invalid-input-secret";
+        "missing-input-response": "missing-input-response";
+        "invalid-input-response": "invalid-input-response";
+        "bad-request": "bad-request";
+        "timeout-or-duplicate": "timeout-or-duplicate";
+        "internal-error": "internal-error";
+    }>>;
+    challenge_ts: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodString>;
+    cdata: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        result_with_testing_key: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type TurnstileValidationResponse = z.infer<typeof turnstileValidationResponseSchema>;
+/**
+ * Verifies a Turnstile token with the Cloudflare Turnstile API.
+ * @param token - The Turnstile token to verify.
+ * @param event - Optional H3 request event.
+ * @param signal - Optional AbortSignal for request cancellation.
+ * @returns The parsed Turnstile validation response.
+ */
+export declare const verifyTurnstileToken: (token: string, event?: H3Event, signal?: AbortSignal) => Promise<TurnstileValidationResponse>;
 /**
  * Validates the Turnstile token from a protected request.
  * @param event - H3 request event.

package/dist/runtime/server/utils/turnstile.js

@@ -1,6 +1,5 @@
 import { createError, getRequestHeader } from "h3";
 import { useRuntimeConfig } from "#imports";
-import { verifyTurnstileToken } from "@nuxtjs/turnstile/runtime/server/utils/verify.js";
 import { isAdmin } from "@onderwijsin/nuxt-module-utils/server";
 import { attempt, hasKey, isNumber, isRecord } from "@onderwijsin/nuxt-module-utils/shared";
 import { z } from "zod";
@@ -10,6 +9,38 @@ const turnstileVerificationSchema = z.object({
   action: z.string().optional(),
   metadata: z.object({ result_with_testing_key: z.boolean().optional() }).optional()
 });
+export const turnstileValidationErrorCodeSchema = z.enum([
+  "missing-input-secret",
+  "invalid-input-secret",
+  "missing-input-response",
+  "invalid-input-response",
+  "bad-request",
+  "timeout-or-duplicate",
+  "internal-error"
+]);
+export const turnstileValidationResponseSchema = z.object({
+  success: z.boolean(),
+  hostname: z.string(),
+  "error-codes": z.array(turnstileValidationErrorCodeSchema),
+  challenge_ts: z.string().optional(),
+  action: z.string().optional(),
+  cdata: z.string().optional(),
+  metadata: z.object({ result_with_testing_key: z.boolean().optional() }).optional()
+});
+const endpoint = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+export const verifyTurnstileToken = async (token, event, signal) => {
+  const secretKey = useRuntimeConfig(event).turnstile.secretKey;
+  const response = await $fetch(endpoint, {
+    method: "POST",
+    body: `secret=${encodeURIComponent(secretKey)}&response=${encodeURIComponent(token)}`,
+    headers: {
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    signal
+  });
+  const data = turnstileValidationResponseSchema.parse(response);
+  return data;
+};
 export async function assertTurnstileToken(event, expectedAction) {
   const config = useRuntimeConfig(event);
   const turnstileConfig = config.turnstile;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Nuxt Turnstile integration with client helpers and server-side validation.",
   "homepage": "https://github.com/onderwijsin/nuxt-modules#readme",
   "bugs": {
@@ -43,7 +43,7 @@
     "defu": "6.1.7",
     "h3": "1.15.11",
     "zod": "4.4.3",
-    "@onderwijsin/nuxt-module-utils": "^0.5.0"
+    "@onderwijsin/nuxt-module-utils": "^0.5.1"
   },
   "devDependencies": {
     "@nuxt/module-builder": "1.0.3",
@@ -53,7 +53,7 @@
     "unbuild": "3.6.1"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "scripts": {
     "build": "nuxt-module-build build",