Add Turnstile captcha to login

backend/config.js

@@ -7,5 +7,6 @@ module.exports = {
     ADMIN_PASSWORD: process.env.ADMIN_PASSWORD || 'admin123',
     JWT_SECRET: process.env.JWT_SECRET || 'super_secret_jwt_key_123',
     DATABASE_URL: process.env.DATABASE_URL || 'postgres://graphuser:graphpassword@localhost:5432/graphdb',
-    N8N_WHATSAPP_TRIGGER_URL: process.env.N8N_WHATSAPP_TRIGGER_URL || 'http://localhost:5678/webhook/whatsapp'
+    N8N_WHATSAPP_TRIGGER_URL: process.env.N8N_WHATSAPP_TRIGGER_URL || 'http://localhost:5678/webhook/whatsapp',
+    TURNSTILE_SECRET_KEY: process.env.TURNSTILE_SECRET_KEY || ''
 };

backend/routes/authRoutes.js

@@ -1,12 +1,49 @@
 const express = require('express');
 const { login } = require('../auth');
+const { TURNSTILE_SECRET_KEY } = require('../config');
 
 const router = express.Router();
+const TURNSTILE_VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
 
-router.post('/login', async (req, res, next) => {
-    const { email, password } = req.body;
+const verifyCaptcha = async (captchaToken, remoteIp) => {
+    if (!TURNSTILE_SECRET_KEY) return true;
+    if (!captchaToken || typeof captchaToken !== 'string') return false;
 
     try {
+        const formData = new URLSearchParams({
+            secret: TURNSTILE_SECRET_KEY,
+            response: captchaToken
+        });
+
+        if (remoteIp) {
+            formData.set('remoteip', remoteIp);
+        }
+
+        const response = await fetch(TURNSTILE_VERIFY_URL, {
+            method: 'POST',
+            body: formData
+        });
+
+        if (!response.ok) return false;
+
+        const result = await response.json();
+        return result.success === true;
+    } catch (error) {
+        console.error('Captcha verification failed', error);
+        return false;
+    }
+};
+
+router.post('/login', async (req, res, next) => {
+    const { email, password, captchaToken } = req.body;
+
+    try {
+        const captchaValid = await verifyCaptcha(captchaToken, req.ip);
+        if (!captchaValid) {
+            res.status(403).json({ error: 'Captcha verification failed' });
+            return;
+        }
+
         const authResult = await login(email, password);
 
         if (!authResult) {