Add Turnstile protection to user actions

2026-09-18 00:39:14 +02:00
parent 79cd7f7475
commit 1970be29e7
25 changed files with 406 additions and 39 deletions
@@ -4,6 +4,7 @@ import config from "@payload-config";
 import { checkRateLimit, getClientIp } from "@/lib/auth/rateLimit";
 import { groupRegistrationEmail } from "@/lib/email/conversationTemplates";
 import { sendEmail } from "@/lib/email/sendBookingEmails";
+import { verifyTurnstileToken } from "@/lib/turnstile/server";

 export const dynamic = "force-dynamic";

@@ -19,6 +20,7 @@ export async function POST(request: Request) {
  const phone = value(body.phone, 80);
  const message = value(body.message, 3000);
  if (!offerSlug || !name || !email || !/^\S+@\S+\.\S+$/.test(email)) return NextResponse.json({ error: "Bitte fülle Name und E-Mail korrekt aus." }, { status: 400 });
+  if (!(await verifyTurnstileToken(body.token, "group-registration", request))) return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });

  try {
    const payload = await getPayload({ config });