@onderwijsin/nuxt-turnstile 0.3.0 → 0.3.2

package/README.md

@@ -103,9 +103,10 @@ export default defineEventHandler(async (event) => {
 });
 ```
 
-The helper reads `x-turnstile-token` and verifies it through `@nuxtjs/turnstile`. It rejects
-missing, failed, unavailable, or mismatched-action tokens. In development, an absent secret leaves
-local forms usable; in production, it produces `TURNSTILE_SERVER_MISCONFIGURED`.
+The helper reads `x-turnstile-token` and verifies it directly with Cloudflare's Turnstile siteverify
+endpoint. It rejects missing, failed, unavailable, or mismatched-action tokens. In development, an
+absent secret leaves local forms usable; in production, it produces
+`TURNSTILE_SERVER_MISCONFIGURED`.
 
 Cloudflare's official test credentials return `metadata.result_with_testing_key: true` without an
 `action`. The helper accepts only that verified test-key response without action matching, so test
@@ -135,7 +136,7 @@ Stable error codes are `TURNSTILE_TOKEN_MISSING`, `TURNSTILE_VALIDATION_FAILED`,
 `TURNSTILE_SERVER_MISCONFIGURED`. Apply authorization and business validation in the consuming route
 after Turnstile succeeds; the module does not replace the route's existing submit or business logic.
 
-`verifyTokenWithTurnstile` is also auto-imported for server-only use when the raw Cloudflare
+`verifyTurnstileToken` is also auto-imported for server-only use when the raw Cloudflare
 verification response is needed. Prefer `assertTurnstileToken` for protected application routes.
 
 ## Compatibility

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
   "configKey": "turnstile",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "compatibility": {
     "nuxt": "^4.0.0"
   },

package/dist/module.mjs

@@ -1,9 +1,10 @@
 import { defineNuxtModule, useLogger, createResolver, addTypeTemplate, addImportsDir, addServerScanDir } from '@nuxt/kit';
 import { defu } from 'defu';
 import { enabled, resolveModuleName, resolveLoggerScope, moduleSetup, validateModuleOptions, transpileRuntime, moduleDependenciesWhenEnabled } from '@onderwijsin/nuxt-module-utils/build';
+import { isRecord, hasKey, isArray, isString } from '@onderwijsin/nuxt-module-utils/shared';
 import { z } from 'zod';
 
-const version = "0.3.0";
+const version = "0.3.2";
 
 const turnstileOptionsSchema = z.object({
   enabled,
@@ -22,6 +23,9 @@ const DEFAULTS = {
   adminToken: "",
   adminHeaderName: "x-admin-token"
 };
+function isUpstreamTurnstileVerifierPreset(preset) {
+  return isRecord(preset) && isString(preset.from) && preset.from.includes("@nuxtjs/turnstile") && isArray(preset.imports) && preset.imports.includes("verifyTurnstileToken");
+}
 const module$1 = defineNuxtModule({
   meta: {
     name: MODULE_NAME,
@@ -59,6 +63,15 @@ const module$1 = defineNuxtModule({
     );
     nuxt.options.turnstile = defu(nuxt.options.turnstile, {});
     nuxt.options.turnstile.siteKey ??= options.siteKey;
+    nuxt.hook("modules:done", () => {
+      nuxt.hook("nitro:config", (nitro) => {
+        const imports = nitro.imports;
+        if (!isRecord(imports) || !hasKey(imports, "presets")) return;
+        const presets = imports.presets;
+        if (!isArray(presets)) return;
+        imports.presets = presets.filter((preset) => !isUpstreamTurnstileVerifierPreset(preset));
+      });
+    });
     transpileRuntime(nuxt, runtimeDir);
     addImportsDir(resolver.resolve(runtimeDir, "app", "composables"));
     addServerScanDir(resolver.resolve(runtimeDir, "server"));

package/dist/runtime/server/utils/turnstile.d.ts

@@ -37,7 +37,7 @@ export type TurnstileValidationResponse = z.infer<typeof turnstileValidationResp
  * @param signal - Optional AbortSignal for request cancellation.
  * @returns The parsed Turnstile validation response.
  */
-export declare const verifyTokenWithTurnstile: (token: string, event?: H3Event, signal?: AbortSignal) => Promise<TurnstileValidationResponse>;
+export declare const verifyTurnstileToken: (token: string, event?: H3Event, signal?: AbortSignal) => Promise<TurnstileValidationResponse>;
 /**
  * Validates the Turnstile token from a protected request.
  * @param event - H3 request event.

package/dist/runtime/server/utils/turnstile.js

@@ -28,7 +28,7 @@ export const turnstileValidationResponseSchema = z.object({
   metadata: z.object({ result_with_testing_key: z.boolean().optional() }).optional()
 });
 const endpoint = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
-export const verifyTokenWithTurnstile = async (token, event, signal) => {
+export const verifyTurnstileToken = async (token, event, signal) => {
   const secretKey = useRuntimeConfig(event).turnstile.secretKey;
   const response = await $fetch(endpoint, {
     method: "POST",
@@ -65,7 +65,7 @@ export async function assertTurnstileToken(event, expectedAction) {
       "TURNSTILE_TOKEN_MISSING",
       expectedAction
     );
-  const result = await attempt(() => verifyTokenWithTurnstile(token));
+  const result = await attempt(() => verifyTurnstileToken(token));
   if (result.error !== null) {
     if (isErrorWithStatusCode(result.error)) throw result.error;
     throw createError({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onderwijsin/nuxt-turnstile",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Nuxt Turnstile integration with client helpers and server-side validation.",
   "homepage": "https://github.com/onderwijsin/nuxt-modules#readme",
   "bugs": {