Add Turnstile protection to user actions

app/(payload)/api/meetings/[slug]/join/route.ts

@@ -7,6 +7,7 @@ import { authorizeMeeting } from "@/lib/meeting/access";
 import { checkRateLimit, getClientIp } from "@/lib/auth/rateLimit";
 import { createLiveKitToken, getLiveKitClientUrl } from "@/lib/meeting/livekit";
 import { isMeetingParticipantKicked } from "@/lib/meeting/kicks";
+import { verifyTurnstileToken } from "@/lib/turnstile/server";
 
 export const dynamic = "force-dynamic";
 
@@ -25,7 +26,7 @@ export async function POST(request: Request, { params }: Args) {
     return NextResponse.json({ error: "Zu viele Beitrittsversuche." }, { status: 429 });
   }
 
-  let body: { name?: unknown; password?: unknown; clientId?: unknown };
+  let body: { name?: unknown; password?: unknown; clientId?: unknown; token?: unknown };
   try {
     body = await request.json();
     if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
@@ -42,6 +43,9 @@ export async function POST(request: Request, { params }: Args) {
   if (password.length > 200) {
     return NextResponse.json({ error: "Das Meeting-Passwort ist ungültig." }, { status: 400 });
   }
+  if (!(await verifyTurnstileToken(body.token, "meeting-join", request))) {
+    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
+  }
 
   try {
     const payload = await getPayload({ config });

app/(payload)/api/meetings/[slug]/register/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getPayload } from "payload";
 import config from "@payload-config";
 import { checkRateLimit, getClientIp } from "@/lib/auth/rateLimit";
+import { verifyTurnstileToken } from "@/lib/turnstile/server";
 
 export const dynamic = "force-dynamic";
 
@@ -35,7 +36,7 @@ export async function POST(request: Request, { params }: Args) {
     return NextResponse.json({ error: "Zu viele Anmeldungen. Bitte versuche es später erneut." }, { status: 429 });
   }
 
-  let body: { name?: unknown; email?: unknown };
+  let body: { name?: unknown; email?: unknown; token?: unknown };
   try {
     body = await request.json();
     if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
@@ -48,6 +49,9 @@ export async function POST(request: Request, { params }: Args) {
   if (!name || name.length > 120 || !email || email.length > 254 || !email.includes("@")) {
     return NextResponse.json({ error: "Bitte gib deinen Namen und eine gültige E-Mail-Adresse an." }, { status: 400 });
   }
+  if (!(await verifyTurnstileToken(body.token, "meeting-registration", request))) {
+    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
+  }
 
   try {
     const payload = await getPayload({ config });