turnstile.server.ts RawHistoryFolder

1import { TURNSTILE_SECRET_KEY } from '$env/static/private';
2import { createLogger } from './logger.server';
3
4const log = createLogger('turnstile');
5const isDev = process.env.NODE_ENV === 'development';
6
7interface TurnstileVerifyResponse {
8    "success": boolean;
9    "error-codes"?: string[];
10    "challenge_ts"?: string;
11    "hostname"?: string;
12    "action"?: string;
13    "cdata"?: string;
14}
15
16export async function validateTurnstileToken(token: string, remoteip?: string): Promise<boolean> {
17    // Always return true in development mode
18    if (isDev) {
19        log.debug('Development mode: bypassing Turnstile validation');
20        return true;
21    }
22
23    try {
24        const formData = new FormData();
25        formData.append('secret', TURNSTILE_SECRET_KEY);
26        formData.append('response', token);
27        if (remoteip) {
28            formData.append('remoteip', remoteip);
29        }
30
31        const url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
32        const result = await fetch(url, {
33            body: formData,
34            method: 'POST',
35        });
36
37        const outcome: TurnstileVerifyResponse = await result.json();
38        
39        if (!outcome.success) {
40            log.warn('Turnstile validation failed', {
41                errors: outcome["error-codes"],
42                remoteip: remoteip ? `${remoteip.split('.')[0]}.xxx.xxx.xxx` : undefined
43            });
44        }
45        
46        return outcome.success;
47    } catch (error) {
48        log.error('Error validating Turnstile token', { error });
49        return false;
50    }
51}