Add Turnstile

[skyfallwastaken]

Add Cloudflare Turnstile integration for bot protection.

Configuration

Set the following environment variables:

Variable	Description
NUXT_TURNSTILE_SECRET_KEY	Cloudflare Turnstile secret key (server-side)
NUXT_PUBLIC_TURNSTILE_SITE_KEY	Cloudflare Turnstile site key (client-side)
NUXT_SESSION_SECRET	A random secret used to sign session tokens

You can get your Turnstile site key and secret key from the Cloudflare dashboard.

[vercel]

@skyfallwastaken is attempting to deploy a commit to the Karo Roghzai's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Pull request overview

Adds Cloudflare Turnstile-based bot protection by introducing a short-lived, HMAC-signed “session token” that must be presented to access protected AI endpoints.

Changes:

• Added server-side session token signing/verification and a /api/session exchange endpoint backed by Turnstile siteverify.
• Introduced server middleware to block bot user agents and require x-session-token for /api/ai and /api/embeddings.
• Added client composables to solve Turnstile, cache/refresh the session token, and attach it to API requests.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
server/utils/session.js	Implements HMAC-signed session tokens with expiry validation.
server/middleware/guard.js	Enforces bot detection + session-token requirement on protected API routes.
server/api/session.post.js	Verifies Turnstile token and issues short-lived signed session tokens.
nuxt.config.ts	Adds runtime config entries for Turnstile keys and sessionSecret.
app/composables/useTurnstile.js	Loads Turnstile script and solves an invisible widget to obtain a token.
app/composables/useSession.js	Exchanges Turnstile token for session token; caches in memory/localStorage with refresh.
app/composables/storeConversations.js	Adds x-session-token to background title-generation requests.
app/composables/message.js	Adds x-session-token to /api/ai requests.
app/composables/memory.js	Adds x-session-token to /api/embeddings requests.
package.json	Bumps version and adds isbot dependency.
package-lock.json	Adds isbot, but also includes metadata/peer-flag churn needing cleanup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.