06/15 Phase 1 + 2 codes

app/services/turnstile.py

@@ -0,0 +1,34 @@
+"""Cloudflare Turnstile verification. Bypasses in dev when no secret is set."""
+import requests
+from flask import current_app, request
+
+_VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify"
+
+
+def turnstile_enabled() -> bool:
+    return bool(current_app.config.get("TURNSTILE_SECRET_KEY"))
+
+
+def verify_turnstile() -> bool:
+    """Validate the cf-turnstile-response token from the current request form."""
+    secret = current_app.config.get("TURNSTILE_SECRET_KEY")
+    if not secret:
+        return True  # dev bypass
+
+    token = request.form.get("cf-turnstile-response", "")
+    if not token:
+        return False
+    try:
+        resp = requests.post(
+            _VERIFY_URL,
+            data={
+                "secret": secret,
+                "response": token,
+                "remoteip": request.remote_addr,
+            },
+            timeout=10,
+        )
+        return bool(resp.json().get("success"))
+    except Exception as exc:  # noqa: BLE001
+        current_app.logger.error("Turnstile verify failed: %s", exc)
+        return False