Inna
aa61f79a55
- lib/turnstile.ts: verifyTurnstile(token, ip) contra siteverify (fail-closed). - components/Turnstile.tsx: widget cliente (carga el script de Cloudflare, callback con el token). Site key por NEXT_PUBLIC_TURNSTILE_SITE_KEY; secreto server-only. - LoginForm/RegisterForm: widget + token en el POST; submit deshabilitado hasta resolver el captcha (si hay site key). - Routes login/register: verifican el token antes de continuar (error captchaFailed). - Catálogos: captchaFailed. Verificado: POST sin token -> captchaFailed en login y registro (enforcement server). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
26 lines
806 B
TypeScript
26 lines
806 B
TypeScript
import { registerAccount } from '@/lib/register'
|
|
import { verifyTurnstile } from '@/lib/turnstile'
|
|
|
|
export async function POST(request: Request) {
|
|
let body: Record<string, string>
|
|
try {
|
|
body = await request.json()
|
|
} catch {
|
|
return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
|
|
}
|
|
|
|
const ip = (request.headers.get('x-forwarded-for') || '').split(',')[0].trim()
|
|
if (!(await verifyTurnstile(body.turnstileToken ?? '', ip))) {
|
|
return Response.json({ success: false, error: 'captchaFailed' })
|
|
}
|
|
|
|
const result = await registerAccount({
|
|
password: body.password ?? '',
|
|
confPassword: body.confPassword ?? '',
|
|
email: body.email ?? '',
|
|
confEmail: body.confEmail ?? '',
|
|
recruiter: body.recruiter ?? '',
|
|
})
|
|
return Response.json(result)
|
|
}
|