rankrunners-cms 0.0.27 → 0.0.29

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rankrunners-cms",
   "type": "module",
-  "version": "0.0.27",
+  "version": "0.0.29",
   "peerDependencies": {
     "@puckeditor/core": "^0.21.1",
     "@tanstack/react-router": "^1.166.6",

package/src/captcha/types.ts

@@ -44,7 +44,7 @@ export type UseCaptcha = {
   captchaError: string | null;
   captchaProgress: number | null;
   resetCaptcha: () => void;
-  consumeCaptchaToken: () => CapToken | null;
+  consumeCaptchaToken: () => string | null;
 };
 
 export type CapWorkerMessage = {

package/src/captcha/use-cap.ts

@@ -236,7 +236,7 @@ export function useCaptcha(props: CapHookProps = {}): UseCaptcha {
   const solvingCaptcha = solving || waitingForRetry;
 
   const consumeCaptchaToken = useCallback(() => {
-    const currentToken = token;
+    const currentToken = token?.token ?? null;
     reset();
     return currentToken;
   }, [token, reset]);

package/src/tanstack/captcha.ts

@@ -0,0 +1,73 @@
+import { verifyToken as verifyTokenClient } from "../api/client/captcha";
+
+export const getIpAddress = (request: Request): string => {
+  const forwardedFor = request.headers.get("x-forwarded-for");
+
+  if (forwardedFor) {
+    // x-forwarded-for can contain multiple IPs, take the first one
+    const splitForwardedFor = forwardedFor.split(",")[0]?.trim();
+
+    if (splitForwardedFor && splitForwardedFor.length > 0) {
+      return splitForwardedFor;
+    }
+  }
+
+  // Common fallback headers set by some proxies/CDNs
+  const realIp = request.headers.get("x-real-ip")?.trim();
+  if (realIp && realIp.length > 0) {
+    return realIp;
+  }
+
+  const cfConnectingIp = request.headers.get("cf-connecting-ip")?.trim();
+  if (cfConnectingIp && cfConnectingIp.length > 0) {
+    return cfConnectingIp;
+  }
+
+  return "";
+};
+
+const getRequestHostname = (request: Request): string => {
+  const referer =
+    request.headers.get("referer") || request.headers.get("referrer");
+  if (referer) {
+    try {
+      return new URL(referer).hostname;
+    } catch {
+      // fall through
+    }
+  }
+  const origin = request.headers.get("origin");
+  if (origin) {
+    try {
+      return new URL(origin).hostname;
+    } catch {
+      // fall through
+    }
+  }
+  const host = request.headers.get("host");
+  if (host) {
+    // Remove port if present
+    const [hostname] = host.split(":");
+    if (hostname && hostname.length > 0) {
+      return hostname;
+    }
+  }
+  return "";
+};
+
+export const verifyToken = async (request: Request, token: string) => {
+  const ip = getIpAddress(request);
+  const hostname = getRequestHostname(request);
+
+  if (ip.length === 0) {
+    console.error("Unable to determine IP address for captcha verification");
+    return false;
+  }
+
+  if (hostname.length === 0) {
+    console.error("Unable to determine hostname for captcha verification");
+    return false;
+  }
+
+  return verifyTokenClient({ token, ip, hostname });
+};