admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
50 lines
1.7 KiB
TypeScript
50 lines
1.7 KiB
TypeScript
/**
|
|
* Client-side Cloudflare Turnstile rollout state for Supabase Auth.
|
|
*
|
|
* The public site key is intentionally safe to ship to the browser. The
|
|
* matching secret stays in Supabase Auth and must never be added to this app.
|
|
* A generic Docker image contains the sentinel below until its entrypoint
|
|
* substitutes the operator's runtime value, so an unsubstituted sentinel must
|
|
* fail open as "disabled" rather than render a broken widget.
|
|
*/
|
|
|
|
const UNCONFIGURED_SITE_KEYS = new Set([
|
|
'',
|
|
'__NEXT_PUBLIC_TURNSTILE_SITE_KEY__',
|
|
])
|
|
|
|
export type TurnstileRolloutState = 'disabled' | 'client-enabled'
|
|
|
|
export function resolveTurnstileSiteKey(
|
|
value: string | undefined = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY,
|
|
): string | null {
|
|
const siteKey = value?.trim() ?? ''
|
|
return UNCONFIGURED_SITE_KEYS.has(siteKey) ? null : siteKey
|
|
}
|
|
|
|
export function getTurnstileRolloutState(
|
|
value: string | undefined = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY,
|
|
): TurnstileRolloutState {
|
|
return resolveTurnstileSiteKey(value) ? 'client-enabled' : 'disabled'
|
|
}
|
|
|
|
export function captchaTokenOptions(
|
|
token: string | null | undefined,
|
|
): { captchaToken?: string } {
|
|
const captchaToken = token?.trim()
|
|
return captchaToken ? { captchaToken } : {}
|
|
}
|
|
|
|
/**
|
|
* Missing CAPTCHA configuration is an intentional rollout state: existing
|
|
* Auth flows keep working until the public site key is deployed. Once a site
|
|
* key exists, every protected form fails closed until Turnstile supplies a
|
|
* token.
|
|
*/
|
|
export function isTurnstileSubmissionBlocked(
|
|
token: string | null | undefined,
|
|
siteKeyValue: string | undefined = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY,
|
|
): boolean {
|
|
return resolveTurnstileSiteKey(siteKeyValue) !== null && !captchaTokenOptions(token).captchaToken
|
|
}
|