From e8eafaf9b9481da33e06c856888a66d9aa0aabd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Faleiros?= <cauefaleiros@gmail.com>
Date: Tue, 28 Jul 2026 11:46:26 -0300
Subject: [PATCH] Use Cloudflare Turnstile secret env name

---
 .env.example                 | 4 ++--
 README.md                    | 4 ++--
 backend/config.js            | 2 +-
 backend/routes/authRoutes.js | 6 +++---
 docker-compose.yml           | 2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.env.example b/.env.example
index 87b3a58..a4ba843 100644
--- a/.env.example
+++ b/.env.example
@@ -22,8 +22,8 @@ JWT_SECRET=super_secret_jwt_key_123
 
 # --- CAPTCHA / Bot Protection (Optional) ---
 # Create keys in Cloudflare Turnstile and set both values in production.
-# When TURNSTILE_SECRET_KEY is empty, backend CAPTCHA enforcement is disabled.
-TURNSTILE_SECRET_KEY=
+# When TURNSTILE_SECRET is empty, backend CAPTCHA enforcement is disabled.
+TURNSTILE_SECRET=
 
 # --- Frontend Configuration (Optional) ---
 # If you need to override the API URL for the frontend
diff --git a/README.md b/README.md
index ff00f06..a85818d 100644
--- a/README.md
+++ b/README.md
@@ -112,11 +112,11 @@ N8N_WHATSAPP_TRIGGER_URL
 ADMIN_EMAIL
 ADMIN_PASSWORD
 JWT_SECRET
-TURNSTILE_SECRET_KEY
+TURNSTILE_SECRET
 VITE_TURNSTILE_SITE_KEY
 ```
 
-`TURNSTILE_SECRET_KEY` enables backend CAPTCHA enforcement on `/api/login`.
+`TURNSTILE_SECRET` enables backend CAPTCHA enforcement on `/api/login`.
 Set `VITE_TURNSTILE_SITE_KEY` at frontend build time to show Cloudflare Turnstile
 on the login page.
 
diff --git a/backend/config.js b/backend/config.js
index 1742b54..4d86a60 100644
--- a/backend/config.js
+++ b/backend/config.js
@@ -8,5 +8,5 @@ module.exports = {
     JWT_SECRET: process.env.JWT_SECRET || 'super_secret_jwt_key_123',
     DATABASE_URL: process.env.DATABASE_URL || 'postgres://graphuser:graphpassword@localhost:5432/graphdb',
     N8N_WHATSAPP_TRIGGER_URL: process.env.N8N_WHATSAPP_TRIGGER_URL || 'http://localhost:5678/webhook/whatsapp',
-    TURNSTILE_SECRET_KEY: process.env.TURNSTILE_SECRET_KEY || ''
+    TURNSTILE_SECRET: process.env.TURNSTILE_SECRET || process.env.TURNSTILE_SECRET_KEY || ''
 };
diff --git a/backend/routes/authRoutes.js b/backend/routes/authRoutes.js
index d224b60..90cc000 100644
--- a/backend/routes/authRoutes.js
+++ b/backend/routes/authRoutes.js
@@ -1,17 +1,17 @@
 const express = require('express');
 const { login } = require('../auth');
-const { TURNSTILE_SECRET_KEY } = require('../config');
+const { TURNSTILE_SECRET } = require('../config');
 
 const router = express.Router();
 const TURNSTILE_VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
 
 const verifyCaptcha = async (captchaToken, remoteIp) => {
-    if (!TURNSTILE_SECRET_KEY) return true;
+    if (!TURNSTILE_SECRET) return true;
     if (!captchaToken || typeof captchaToken !== 'string') return false;
 
     try {
         const formData = new URLSearchParams({
-            secret: TURNSTILE_SECRET_KEY,
+            secret: TURNSTILE_SECRET,
             response: captchaToken
         });
 
diff --git a/docker-compose.yml b/docker-compose.yml
index d3c50c2..ec56bdc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -27,7 +27,7 @@ services:
       - ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin123}
       - JWT_SECRET=${JWT_SECRET:-super_secret_jwt_key_123}
       - N8N_WHATSAPP_TRIGGER_URL=${N8N_WHATSAPP_TRIGGER_URL:-http://localhost:5678/webhook/whatsapp}
-      - TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY:-}
+      - TURNSTILE_SECRET=${TURNSTILE_SECRET:-${TURNSTILE_SECRET_KEY:-}}
     depends_on:
       - db
     restart: unless-stopped