challenge

type SiteVerify struct {
	// URL is the siteverify endpoint.
	URL string
	// Secret is the server-side secret key.
	Secret config.Secret
	// FormField is the form field the widget fills in (the Header is also
	// read, for JSON requests).
	FormField string
	// Hostname, when set, must equal the hostname the provider reports the
	// widget was solved on, so a token solved on another site is refused.
	Hostname string
	// Action, when set, must equal the action the provider reports (the
	// widget's data-action, a Turnstile feature), so a token solved on the
	// newsletter form is refused on the login form.
	Action string
	// Client sends the request; nil uses httpclient.Safe with a 5s timeout.
	Client *http.Client
	// InsecureFailOpen lets requests through while the provider is unavailable
	// (ErrUnavailable), logging a "challenge.fail_open" security event.
	// The default (false) denies with 503: no bot gets in during an
	// outage, and neither does anyone else. A misconfigured secret never
	// fails open.
	InsecureFailOpen bool
}

type StepUp struct {
	// Turnstile holds the keys; StepUp is off (Require passes) when it is.
	Turnstile TurnstileConfig
	// Verifier checks the token; nil uses Turnstile.Verifier(Action).
	Verifier Verifier
	// Action is the widget's data-action, checked by the default
	// Verifier ("step-up").
	Action string
	// Path is the route Handle is mounted on ("/challenge").
	Path string
	// TTL is how long a clearance lasts (30 minutes).
	TTL time.Duration
	// Cookie is the clearance cookie name ("vukem_clearance").
	Cookie string
	// Skip exempts a request from Require (verified search crawlers,
	// signed-in users): the app decides, StepUp never guesses.
	Skip func(c *web.Ctx) bool
	// Now is the clock (time.Now).
	Now func() time.Time
	// contains filtered or unexported fields
}

type TurnstileConfig struct {
	// SiteKey is the public widget key (Cloudflare dashboard > Turnstile).
	SiteKey string `env:"TURNSTILE_SITE_KEY"`
	// SecretKey is the server-side key; it prints as "[redacted]".
	SecretKey config.Secret `env:"TURNSTILE_SECRET_KEY"`
	// Hostname, when set, must equal the hostname the widget was solved
	// on, so a token solved on another site is refused.
	Hostname string `env:"TURNSTILE_HOSTNAME"`
	// Timeout bounds each siteverify call (one retry on a network error
	// or a 5xx answer).
	Timeout time.Duration `env:"TURNSTILE_TIMEOUT" default:"5s"`
	// InsecureFailOpen lets requests through while Cloudflare cannot
	// answer; see SiteVerify.InsecureFailOpen. Off: an outage denies (503).
	InsecureFailOpen bool `env:"TURNSTILE_INSECURE_FAIL_OPEN"`
}

type Verifier interface {
	// Verify returns nil for a valid answer, an error wrapping ErrRejected
	// for a missing or wrong one, and any other error when it cannot tell.
	Verify(c *web.Ctx) error
}