Spaces:
Sleeping
Sleeping
| import { RECAPTCHA_ACTION, RECAPTCHA_MIN_SCORE, RECAPTCHA_VERIFY_URL } from "./constants.js"; | |
| // Verify a reCAPTCHA v3 token with Google. Returns { ok, reason }. | |
| // With no secret configured it passes in development and fails closed in production. | |
| export async function verifyRecaptcha(token, ip, { secret = process.env.RECAPTCHA_SECRET, fetchFn = fetch, production = process.env.NODE_ENV === "production" } = {}) { | |
| if (!secret) return production ? { ok: false, reason: "not-configured" } : { ok: true, reason: "dev-skip" }; | |
| if (typeof token !== "string" || !token) return { ok: false, reason: "missing-token" }; | |
| try { | |
| const body = new URLSearchParams({ secret, response: token }); | |
| if (ip) body.set("remoteip", ip); | |
| const res = await fetchFn(RECAPTCHA_VERIFY_URL, { method: "POST", body }); | |
| const data = await res.json(); | |
| if (!data.success) return { ok: false, reason: "rejected" }; | |
| if (data.action && data.action !== RECAPTCHA_ACTION) return { ok: false, reason: "wrong-action" }; | |
| if (typeof data.score === "number" && data.score < RECAPTCHA_MIN_SCORE) return { ok: false, reason: "low-score" }; | |
| return { ok: true, reason: "verified" }; | |
| } catch { | |
| return { ok: false, reason: "unreachable" }; | |
| } | |
| } | |