Add Turnstile protection to user actions

app/(payload)/api/customers/login/route.ts

@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+import { REST_POST } from "@payloadcms/next/routes";
+import config from "@payload-config";
+import { verifyTurnstileToken } from "@/lib/turnstile/server";
+
+export const dynamic = "force-dynamic";
+
+const payloadPost = REST_POST(config);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export async function POST(request: Request) {
+  let body: unknown;
+  try {
+    body = await request.clone().json();
+  } catch {
+    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
+  }
+
+  const token = isRecord(body) ? body.token : undefined;
+  if (!(await verifyTurnstileToken(token, "login", request))) {
+    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
+  }
+
+  const sanitizedBody = isRecord(body) ? { ...body } : body;
+  if (isRecord(sanitizedBody)) delete sanitizedBody.token;
+  const headers = new Headers(request.headers);
+  headers.delete("content-length");
+  headers.set("content-type", "application/json");
+  const downstreamRequest = new Request(request.url, {
+    method: request.method,
+    headers,
+    body: JSON.stringify(sanitizedBody),
+  });
+  return payloadPost(downstreamRequest, { params: Promise.resolve({ slug: ["customers", "login"] }) });
+}

app/(payload)/api/customers/route.ts

@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+import { REST_POST } from "@payloadcms/next/routes";
+import config from "@payload-config";
+import { verifyTurnstileToken } from "@/lib/turnstile/server";
+
+export const dynamic = "force-dynamic";
+
+const payloadPost = REST_POST(config);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export async function POST(request: Request) {
+  let body: unknown;
+  try {
+    body = await request.clone().json();
+  } catch {
+    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
+  }
+
+  const token = isRecord(body) ? body.token : undefined;
+  if (!(await verifyTurnstileToken(token, "registration", request))) {
+    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
+  }
+
+  const sanitizedBody = isRecord(body) ? { ...body } : body;
+  if (isRecord(sanitizedBody)) delete sanitizedBody.token;
+  const headers = new Headers(request.headers);
+  headers.delete("content-length");
+  headers.set("content-type", "application/json");
+  const downstreamRequest = new Request(request.url, {
+    method: request.method,
+    headers,
+    body: JSON.stringify(sanitizedBody),
+  });
+  return payloadPost(downstreamRequest, { params: Promise.resolve({ slug: ["customers"] }) });
+}