@onderwijsin/nuxt-turnstile 0.2.9 → 0.3.0

package/README.md

@@ -135,6 +135,9 @@ Stable error codes are `TURNSTILE_TOKEN_MISSING`, `TURNSTILE_VALIDATION_FAILED`,
 `TURNSTILE_SERVER_MISCONFIGURED`. Apply authorization and business validation in the consuming route
 after Turnstile succeeds; the module does not replace the route's existing submit or business logic.
 
+`verifyTokenWithTurnstile` is also auto-imported for server-only use when the raw Cloudflare
+verification response is needed. Prefer `assertTurnstileToken` for protected application routes.
+
 ## Compatibility
 
 - Nuxt 4

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
   "configKey": "turnstile",
-  "version": "0.2.9",
+  "version": "0.3.0",
   "compatibility": {
     "nuxt": "^4.0.0"
   },

package/dist/module.mjs

@@ -3,7 +3,7 @@ import { defu } from 'defu';
 import { enabled, resolveModuleName, resolveLoggerScope, moduleSetup, validateModuleOptions, transpileRuntime, moduleDependenciesWhenEnabled } from '@onderwijsin/nuxt-module-utils/build';
 import { z } from 'zod';
 
-const version = "0.2.9";
+const version = "0.3.0";
 
 const turnstileOptionsSchema = z.object({
   enabled,

package/dist/runtime/server/utils/turnstile.d.ts

@@ -1,5 +1,43 @@
 import type { H3Event } from "h3";
+import { z } from "zod";
 import type { TurnstileErrorCode, TurnstileErrorData } from "../../types/errors.js";
+export declare const turnstileValidationErrorCodeSchema: z.ZodEnum<{
+    "missing-input-secret": "missing-input-secret";
+    "invalid-input-secret": "invalid-input-secret";
+    "missing-input-response": "missing-input-response";
+    "invalid-input-response": "invalid-input-response";
+    "bad-request": "bad-request";
+    "timeout-or-duplicate": "timeout-or-duplicate";
+    "internal-error": "internal-error";
+}>;
+export declare const turnstileValidationResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    hostname: z.ZodString;
+    "error-codes": z.ZodArray<z.ZodEnum<{
+        "missing-input-secret": "missing-input-secret";
+        "invalid-input-secret": "invalid-input-secret";
+        "missing-input-response": "missing-input-response";
+        "invalid-input-response": "invalid-input-response";
+        "bad-request": "bad-request";
+        "timeout-or-duplicate": "timeout-or-duplicate";
+        "internal-error": "internal-error";
+    }>>;
+    challenge_ts: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodString>;
+    cdata: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        result_with_testing_key: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type TurnstileValidationResponse = z.infer<typeof turnstileValidationResponseSchema>;
+/**
+ * Verifies a Turnstile token with the Cloudflare Turnstile API.
+ * @param token - The Turnstile token to verify.
+ * @param event - Optional H3 request event.
+ * @param signal - Optional AbortSignal for request cancellation.
+ * @returns The parsed Turnstile validation response.
+ */
+export declare const verifyTokenWithTurnstile: (token: string, event?: H3Event, signal?: AbortSignal) => Promise<TurnstileValidationResponse>;
 /**
  * Validates the Turnstile token from a protected request.
  * @param event - H3 request event.

package/dist/runtime/server/utils/turnstile.js

@@ -1,6 +1,5 @@
 import { createError, getRequestHeader } from "h3";
 import { useRuntimeConfig } from "#imports";
-import { verifyTurnstileToken } from "@nuxtjs/turnstile/runtime/server/utils/verify.js";
 import { isAdmin } from "@onderwijsin/nuxt-module-utils/server";
 import { attempt, hasKey, isNumber, isRecord } from "@onderwijsin/nuxt-module-utils/shared";
 import { z } from "zod";
@@ -10,6 +9,38 @@ const turnstileVerificationSchema = z.object({
   action: z.string().optional(),
   metadata: z.object({ result_with_testing_key: z.boolean().optional() }).optional()
 });
+export const turnstileValidationErrorCodeSchema = z.enum([
+  "missing-input-secret",
+  "invalid-input-secret",
+  "missing-input-response",
+  "invalid-input-response",
+  "bad-request",
+  "timeout-or-duplicate",
+  "internal-error"
+]);
+export const turnstileValidationResponseSchema = z.object({
+  success: z.boolean(),
+  hostname: z.string(),
+  "error-codes": z.array(turnstileValidationErrorCodeSchema),
+  challenge_ts: z.string().optional(),
+  action: z.string().optional(),
+  cdata: z.string().optional(),
+  metadata: z.object({ result_with_testing_key: z.boolean().optional() }).optional()
+});
+const endpoint = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+export const verifyTokenWithTurnstile = async (token, event, signal) => {
+  const secretKey = useRuntimeConfig(event).turnstile.secretKey;
+  const response = await $fetch(endpoint, {
+    method: "POST",
+    body: `secret=${encodeURIComponent(secretKey)}&response=${encodeURIComponent(token)}`,
+    headers: {
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    signal
+  });
+  const data = turnstileValidationResponseSchema.parse(response);
+  return data;
+};
 export async function assertTurnstileToken(event, expectedAction) {
   const config = useRuntimeConfig(event);
   const turnstileConfig = config.turnstile;
@@ -34,7 +65,7 @@ export async function assertTurnstileToken(event, expectedAction) {
       "TURNSTILE_TOKEN_MISSING",
       expectedAction
     );
-  const result = await attempt(() => verifyTurnstileToken(token));
+  const result = await attempt(() => verifyTokenWithTurnstile(token));
   if (result.error !== null) {
     if (isErrorWithStatusCode(result.error)) throw result.error;
     throw createError({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
-  "version": "0.2.9",
+  "version": "0.3.0",
   "description": "Nuxt Turnstile integration with client helpers and server-side validation.",
   "homepage": "https://github.com/onderwijsin/nuxt-modules#readme",
   "bugs": {