rankrunners-cms 0.0.27 → 0.0.28

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rankrunners-cms",
   "type": "module",
-  "version": "0.0.27",
+  "version": "0.0.28",
   "peerDependencies": {
     "@puckeditor/core": "^0.21.1",
     "@tanstack/react-router": "^1.166.6",

package/src/tanstack/captcha.ts

@@ -0,0 +1,73 @@
+import { verifyToken as verifyTokenClient } from "../api/client/captcha";
+
+export const getIpAddress = (request: Request): string => {
+  const forwardedFor = request.headers.get("x-forwarded-for");
+
+  if (forwardedFor) {
+    // x-forwarded-for can contain multiple IPs, take the first one
+    const splitForwardedFor = forwardedFor.split(",")[0]?.trim();
+
+    if (splitForwardedFor && splitForwardedFor.length > 0) {
+      return splitForwardedFor;
+    }
+  }
+
+  // Common fallback headers set by some proxies/CDNs
+  const realIp = request.headers.get("x-real-ip")?.trim();
+  if (realIp && realIp.length > 0) {
+    return realIp;
+  }
+
+  const cfConnectingIp = request.headers.get("cf-connecting-ip")?.trim();
+  if (cfConnectingIp && cfConnectingIp.length > 0) {
+    return cfConnectingIp;
+  }
+
+  return "";
+};
+
+const getRequestHostname = (request: Request): string => {
+  const referer =
+    request.headers.get("referer") || request.headers.get("referrer");
+  if (referer) {
+    try {
+      return new URL(referer).hostname;
+    } catch {
+      // fall through
+    }
+  }
+  const origin = request.headers.get("origin");
+  if (origin) {
+    try {
+      return new URL(origin).hostname;
+    } catch {
+      // fall through
+    }
+  }
+  const host = request.headers.get("host");
+  if (host) {
+    // Remove port if present
+    const [hostname] = host.split(":");
+    if (hostname && hostname.length > 0) {
+      return hostname;
+    }
+  }
+  return "";
+};
+
+export const verifyToken = async (request: Request, token: string) => {
+  const ip = getIpAddress(request);
+  const hostname = getRequestHostname(request);
+
+  if (ip.length === 0) {
+    console.error("Unable to determine IP address for captcha verification");
+    return false;
+  }
+
+  if (hostname.length === 0) {
+    console.error("Unable to determine hostname for captcha verification");
+    return false;
+  }
+
+  return verifyTokenClient({ token, ip, hostname });
+};