Update turnstile.js

public/js/turnstile.js

@@ -1,5 +1,6 @@
 // turnstile.js — show overlay and handle verification
 (function() {
+  let handled = false;
   function hasTurnstileCookie() {
     return document.cookie.split(';').some(c => c.trim().startsWith('turnstile='));
   }
@@ -16,21 +17,66 @@
     if (pageRoot) pageRoot.classList.add('page-faded');
   }
 
-  // Global callback for Cloudflare Turnstile
-  window.onTurnstileSuccess = async function(token) {
-    try {
-      // Try REST verify first (sets cookie)
-      await fetch('/api/turnstile', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ token }) });
-    } catch (e) {
-      console.error('Turnstile REST verify failed', e);
-    }
-    // Also notify server over websocket (if connected)
+  // Helper: set local cookie so reload won't re-show challenge
+  function setLocalTurnstileCookie() {
     try {
-      if (window.ws?.send) window.ws.send({ type: 'turnstile:verify', token });
+      document.cookie = 'turnstile=1; path=/; max-age=' + (24 * 3600);
     } catch (e) { /* ignore */ }
+  }
+
+  // Attempt websocket verify first, then fallback to REST if needed.
+  async function doWebsocketVerify(token) {
+    return new Promise(resolve => {
+      if (!window.ws || !window.ws.send || !window.ws.isConnected || !window.ws.on) return resolve(false);
+      // If websocket not connected, bail
+      if (!window.ws.isConnected()) return resolve(false);
+
+      let done = false;
+      const onOk = () => { if (done) return; done = true; try { unsub(); unsubErr(); } catch {} resolve(true); };
+      const onErr = () => { if (done) return; done = true; try { unsub(); unsubErr(); } catch {} resolve(false); };
+
+      // Listen for server ack
+      const unsub = window.ws.on('turnstile:ok', () => { onOk(); });
+      const unsubErr = window.ws.on('turnstile:error', () => { onErr(); });
+
+      // Send verify message
+      try { window.ws.send({ type: 'turnstile:verify', token }); }
+      catch (e) { unsub(); unsubErr(); resolve(false); }
+
+      // Fallback timeout
+      setTimeout(() => { if (!done) { try { unsub(); unsubErr(); } catch {} resolve(false); } }, 3500);
+    });
+  }
 
-    // Hide overlay
-    hideOverlay();
+  async function doRestVerify(token) {
+    try {
+      const r = await fetch('/api/turnstile', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ token }) });
+      if (r.ok) return true;
+    } catch (e) { console.error('Turnstile REST verify failed', e); }
+    return false;
+  }
+
+  // Global callback for Cloudflare Turnstile — ensure single handling
+  window.onTurnstileSuccess = async function(token) {
+    if (!token || handled) return; handled = true;
+
+    // Prefer websocket verify for immediate session validation
+    let ok = await doWebsocketVerify(token);
+    if (ok) {
+      setLocalTurnstileCookie();
+      hideOverlay();
+      return;
+    }
+
+    // Fallback to REST verify (sets cookie server-side)
+    ok = await doRestVerify(token);
+    if (ok) setLocalTurnstileCookie();
+    if (ok) hideOverlay();
+    else {
+      // If both failed, allow retry by resetting handled after short delay
+      handled = false;
+      showOverlay();
+    }
   };
 
   // Initialize visibility