@riocrypto/common-server 1.0.2696 → 1.0.2698

package/build/index.d.ts

@@ -9,6 +9,7 @@ export * from "./middlewares/require-min-admin-role";
 export * from "./middlewares/verify-csrf-token";
 export * from "./middlewares/dynamic-rate-limiter";
 export * from "./middlewares/auth-context";
+export * from "./middlewares/verify-turnstile";
 export * from "./services/apiKey";
 export * from "./services/password";
 export * from "./services/logger";

package/build/index.js

@@ -25,6 +25,7 @@ __exportStar(require("./middlewares/require-min-admin-role"), exports);
 __exportStar(require("./middlewares/verify-csrf-token"), exports);
 __exportStar(require("./middlewares/dynamic-rate-limiter"), exports);
 __exportStar(require("./middlewares/auth-context"), exports);
+__exportStar(require("./middlewares/verify-turnstile"), exports);
 __exportStar(require("./services/apiKey"), exports);
 __exportStar(require("./services/password"), exports);
 __exportStar(require("./services/logger"), exports);

package/build/middlewares/verify-turnstile.d.ts

@@ -0,0 +1,44 @@
+import { Request, Response, NextFunction } from "express";
+interface TurnstileConfig {
+    /**
+     * The Turnstile secret key (from Cloudflare dashboard)
+     * Can be obtained from: https://dash.cloudflare.com/?to=/:account/turnstile
+     */
+    secretKey: string;
+    /**
+     * Field name in request body that contains the turnstile token
+     * Default: "turnstileToken"
+     */
+    tokenField?: string;
+    /**
+     * Whether to skip verification in development/test environments
+     * Default: false
+     */
+    skipInDevelopment?: boolean;
+    /**
+     * Custom error message when verification fails
+     */
+    errorMessage?: string;
+    /**
+     * Logger function for errors
+     */
+    logger?: {
+        warn: (msg: object) => void;
+        error: (msg: object) => void;
+    };
+}
+/**
+ * Creates a middleware that verifies Cloudflare Turnstile tokens
+ *
+ * @example
+ * ```typescript
+ * const verifyTurnstile = createTurnstileMiddleware({
+ *   secretKey: process.env.TURNSTILE_SECRET_KEY!,
+ *   skipInDevelopment: process.env.NODE_ENV !== 'production',
+ * });
+ *
+ * app.post('/api/auth/send-code', verifyTurnstile, sendCodeHandler);
+ * ```
+ */
+export declare function createTurnstileMiddleware(config: TurnstileConfig): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+export { TurnstileConfig };

package/build/middlewares/verify-turnstile.js

@@ -0,0 +1,120 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTurnstileMiddleware = void 0;
+const axios_1 = __importDefault(require("axios"));
+const TURNSTILE_VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+/**
+ * Normalize IP address (handle IPv4-mapped IPv6)
+ */
+function normalizeIp(ip) {
+    if (!ip)
+        return undefined;
+    if (ip.startsWith("::ffff:")) {
+        return ip.substring(7);
+    }
+    return ip;
+}
+/**
+ * Get client IP from request, prioritizing Cloudflare headers
+ */
+function getClientIp(req) {
+    const cfConnectingIp = req.headers["cf-connecting-ip"];
+    const xForwardedFor = req.headers["x-forwarded-for"];
+    if (cfConnectingIp) {
+        return normalizeIp(cfConnectingIp);
+    }
+    if (xForwardedFor) {
+        return normalizeIp(xForwardedFor.split(",")[0].trim());
+    }
+    return normalizeIp(req.ip);
+}
+/**
+ * Creates a middleware that verifies Cloudflare Turnstile tokens
+ *
+ * @example
+ * ```typescript
+ * const verifyTurnstile = createTurnstileMiddleware({
+ *   secretKey: process.env.TURNSTILE_SECRET_KEY!,
+ *   skipInDevelopment: process.env.NODE_ENV !== 'production',
+ * });
+ *
+ * app.post('/api/auth/send-code', verifyTurnstile, sendCodeHandler);
+ * ```
+ */
+function createTurnstileMiddleware(config) {
+    const { secretKey, tokenField = "turnstileToken", skipInDevelopment = false, errorMessage = "Human verification failed. Please try again.", logger, } = config;
+    if (!secretKey) {
+        throw new Error("[Turnstile] Secret key is required. Get it from https://dash.cloudflare.com/?to=/:account/turnstile");
+    }
+    return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        // Skip in development if configured
+        if (skipInDevelopment) {
+            return next();
+        }
+        const token = (_a = req.body) === null || _a === void 0 ? void 0 : _a[tokenField];
+        if (!token) {
+            logger === null || logger === void 0 ? void 0 : logger.warn({
+                message: "Turnstile token missing from request",
+                path: req.path,
+                ip: getClientIp(req),
+            });
+            res.status(400).json({
+                error: "Verification token is required.",
+            });
+            return;
+        }
+        try {
+            const remoteIp = getClientIp(req);
+            const response = yield axios_1.default.post(TURNSTILE_VERIFY_URL, new URLSearchParams(Object.assign({ secret: secretKey, response: token }, (remoteIp && { remoteip: remoteIp }))), {
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                timeout: 10000, // 10 second timeout
+            });
+            if (response.data.success) {
+                // Verification successful
+                return next();
+            }
+            // Verification failed
+            logger === null || logger === void 0 ? void 0 : logger.warn({
+                message: "Turnstile verification failed",
+                path: req.path,
+                ip: remoteIp,
+                errorCodes: response.data["error-codes"],
+            });
+            res.status(403).json({
+                error: errorMessage,
+                codes: response.data["error-codes"],
+            });
+        }
+        catch (error) {
+            logger === null || logger === void 0 ? void 0 : logger.error({
+                message: "Error verifying Turnstile token",
+                path: req.path,
+                ip: getClientIp(req),
+                error: error instanceof Error ? error.message : String(error),
+            });
+            // On error, we could either:
+            // 1. Block the request (more secure)
+            // 2. Allow it through (better UX but less secure)
+            // Here we block to be safe
+            res.status(500).json({
+                error: "Verification service unavailable. Please try again.",
+            });
+        }
+    });
+}
+exports.createTurnstileMiddleware = createTurnstileMiddleware;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2696",
+  "version": "1.0.2698",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",