Added claudflare Turnstile captcha support

src/admin.rs

@@ -798,6 +798,8 @@ struct SettingsForm {
     timezone: String,
     site_domain: String,
     seo_keywords: String,
+    turnstile_site_key: String,
+    turnstile_secret_key: String,
 }
 
 async fn save_settings(request: Request, session: Session, db: Database) -> cot::Result<Response> {
@@ -814,6 +816,8 @@ async fn save_settings(request: Request, session: Session, db: Database) -> cot:
         ("timezone", form.timezone),
         ("site_domain", form.site_domain),
         ("seo_keywords", form.seo_keywords),
+        ("turnstile_site_key", form.turnstile_site_key),
+        ("turnstile_secret_key", form.turnstile_secret_key),
     ] {
         let k = key.to_string();
         let existing = query!(Setting, $key == k).get(&db).await?;

src/i18n.rs

@@ -135,6 +135,8 @@ pub struct Translations {
     pub settings_timezone: &'static str,
     pub settings_site_domain: &'static str,
     pub settings_seo_keywords: &'static str,
+    pub settings_turnstile_site_key: &'static str,
+    pub settings_turnstile_secret_key: &'static str,
     pub landing_contact_label: &'static str,
     pub landing_pricing_title: &'static str,
 
@@ -348,6 +350,8 @@ static RU: Translations = Translations {
     settings_timezone: "Часовой пояс (например Asia/Vladivostok)",
     settings_site_domain: "Домен сайта (например https://example.com)",
     settings_seo_keywords: "SEO-ключевые слова (через запятую, отображаются на сайте и в мета-теге keywords)",
+    settings_turnstile_site_key: "Cloudflare Turnstile — Site Key (ключ виджета)",
+    settings_turnstile_secret_key: "Cloudflare Turnstile — Secret Key (секретный ключ)",
     landing_contact_label: "Или свяжитесь с нами напрямую",
     landing_pricing_title: "Стоимость",
 
@@ -551,6 +555,8 @@ static EN: Translations = Translations {
     settings_timezone: "Timezone (e.g. Asia/Vladivostok)",
     settings_site_domain: "Site domain (e.g. https://example.com)",
     settings_seo_keywords: "SEO keywords (comma-separated, shown on site and in keywords meta tag)",
+    settings_turnstile_site_key: "Cloudflare Turnstile — Site Key",
+    settings_turnstile_secret_key: "Cloudflare Turnstile — Secret Key",
     landing_contact_label: "Or contact us directly",
     landing_pricing_title: "Pricing",
 

src/public.rs

@@ -76,6 +76,7 @@ struct LandingTemplate<'a> {
     testimonials: Vec<Testimonial>,
     site_domain: String,
     review_count: usize,
+    turnstile_site_key: String,
 }
 
 #[derive(Debug, Template)]
@@ -138,6 +139,12 @@ async fn landing_page(request: Request, db: Database) -> cot::Result<Response> {
         .await?
         .map(|s| s.value)
         .unwrap_or_default();
+    let turnstile_key = "turnstile_site_key".to_string();
+    let turnstile_site_key = query!(Setting, $key == turnstile_key)
+        .get(&db)
+        .await?
+        .map(|s| s.value)
+        .unwrap_or_default();
     let mut testimonials = Testimonial::objects().all(&db).await?;
     testimonials.retain(|t| t.status == "active");
     testimonials.sort_by(|a, b| a.sort_order.cmp(&b.sort_order));
@@ -151,6 +158,7 @@ async fn landing_page(request: Request, db: Database) -> cot::Result<Response> {
         testimonials,
         site_domain,
         review_count,
+        turnstile_site_key,
     }
     .render()?;
     html_response(body, lang)
@@ -161,6 +169,8 @@ struct LeadForm {
     name: String,
     phone: Option<String>,
     comment: Option<String>,
+    #[serde(default, rename = "cf-turnstile-response")]
+    cf_turnstile_response: Option<String>,
 }
 
 async fn submit_lead(request: Request, db: Database) -> cot::Result<Response> {
@@ -170,6 +180,37 @@ async fn submit_lead(request: Request, db: Database) -> cot::Result<Response> {
     let form: LeadForm =
         serde_html_form::from_bytes(&bytes).map_err(|e| cot::Error::internal(e.to_string()))?;
 
+    // Turnstile CAPTCHA verification (only when secret key is configured)
+    let secret_key_name = "turnstile_secret_key".to_string();
+    let secret_key = query!(Setting, $key == secret_key_name)
+        .get(&db)
+        .await?
+        .map(|s| s.value)
+        .filter(|s| !s.is_empty());
+    if let Some(secret) = secret_key {
+        let token = form.cf_turnstile_response.as_deref().unwrap_or("");
+        let client = reqwest::Client::new();
+        let resp = client
+            .post("https://challenges.cloudflare.com/turnstile/v0/siteverify")
+            .json(&serde_json::json!({
+                "secret": secret,
+                "response": token
+            }))
+            .send()
+            .await;
+        let verified = match resp {
+            Ok(r) => r
+                .json::<serde_json::Value>()
+                .await
+                .map(|v| v["success"].as_bool() == Some(true))
+                .unwrap_or(false),
+            Err(_) => false,
+        };
+        if !verified {
+            return Redirect::new(format!("/?lang={}", lang.code())).into_response();
+        }
+    }
+
     let mut lead = Lead {
         id: Auto::auto(),
         name: form.name,