release: v1.2.7 — 登录人机验证（滑块 / Turnstile / Cap）

server/utils/verify-turnstile.ts

@@ -0,0 +1,36 @@
+interface TurnstileVerifyResult {
+  success?: boolean
+}
+
+export async function verifyTurnstileToken(
+  secret: string,
+  token: string,
+  remoteIp?: string
+): Promise<boolean> {
+  if (!secret || !token) return false
+
+  const params = new URLSearchParams({
+    secret,
+    response: token
+  })
+  if (remoteIp) {
+    params.set('remoteip', remoteIp)
+  }
+
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), 5000)
+  try {
+    const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: params,
+      signal: controller.signal
+    })
+    const result = await response.json() as TurnstileVerifyResult
+    return result.success === true
+  } catch {
+    return false
+  } finally {
+    clearTimeout(timeout)
+  }
+}