feat: /api/share 加入 Turnstile 人機驗證，並提取共用驗證函式

Author: alvin000009238

grades_dashboard.js

@@ -1101,6 +1101,7 @@ function setupShareFeature() {
                     </svg>
                     建立分享連結
                 </button>
+                <div id="shareTurnstileContainer" style="display: flex; justify-content: center; margin-top: 12px;"></div>
                 <div id="shareStatus" class="status-msg"></div>
             </div>
         `;
@@ -1123,11 +1124,52 @@ function setupShareFeature() {
             createLinkBtn.textContent = '建立中...';
             shareStatus.textContent = '';
 
+            // 取得 Turnstile token
+            let turnstileResponse = '';
+            if (typeof turnstile !== 'undefined') {
+                const shareTurnstileContainer = document.getElementById('shareTurnstileContainer');
+                if (shareTurnstileContainer) {
+                    // 渲染 widget (如果尚未渲染)
+                    if (!shareTurnstileContainer.dataset.widgetId) {
+                        try {
+                            const siteKeyRes = await fetch('/api/turnstile-site-key');
+                            const siteKeyData = await siteKeyRes.json();
+                            const siteKey = siteKeyData.siteKey;
+                            if (siteKey) {
+                                const widgetId = turnstile.render(shareTurnstileContainer, {
+                                    sitekey: siteKey,
+                                    theme: 'dark',
+                                });
+                                shareTurnstileContainer.dataset.widgetId = widgetId;
+                                // 等待用戶完成驗證
+                                createLinkBtn.disabled = false;
+                                createLinkBtn.textContent = '建立分享連結';
+                                shareStatus.textContent = '請先完成人機驗證';
+                                shareStatus.className = 'status-msg';
+                                return;
+                            }
+                        } catch (e) {
+                            console.warn('Failed to render share Turnstile:', e);
+                        }
+                    } else {
+                        turnstileResponse = turnstile.getResponse(shareTurnstileContainer.dataset.widgetId) || '';
+                        if (!turnstileResponse) {
+                            shareStatus.textContent = '請完成人機驗證';
+                            shareStatus.className = 'status-msg error';
+                            createLinkBtn.disabled = false;
+                            createLinkBtn.textContent = '建立分享連結';
+                            return;
+                        }
+                    }
+                }
+            }
+
             try {
+                const payload = { ...gradesData, 'cf-turnstile-response': turnstileResponse };
                 const res = await fetch('/api/share', {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify(gradesData)
+                    body: JSON.stringify(payload)
                 });
                 const data = await res.json();
 

server.py

@@ -56,6 +56,31 @@
 TURNSTILE_SECRET_KEY = os.environ.get('TURNSTILE_SECRET_KEY', '')
 TURNSTILE_SITE_KEY = os.environ.get('TURNSTILE_SITE_KEY', '')
 
+def verify_turnstile(token, remote_ip, context=''):
+    """共用 Turnstile 驗證函式。回傳 (success: bool, error_response or None)。"""
+    if not TURNSTILE_SECRET_KEY:
+        return True, None
+    if not token:
+        return False, (jsonify({'success': False, 'message': '請完成人機驗證'}), 400)
+    try:
+        verify_res = http_requests.post(
+            'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+            data={
+                'secret': TURNSTILE_SECRET_KEY,
+                'response': token,
+                'remoteip': remote_ip
+            },
+            timeout=10
+        )
+        verify_data = verify_res.json()
+        if not verify_data.get('success'):
+            logger.warning(f"Turnstile verification failed ({context}): {verify_data}")
+            return False, (jsonify({'success': False, 'message': '人機驗證失敗，請重試'}), 403)
+    except Exception as e:
+        logger.error(f"Turnstile verification error ({context}): {e}")
+        return False, (jsonify({'success': False, 'message': '驗證服務暫時無法使用，請稍後再試'}), 500)
+    return True, None
+
 
 if not os.path.exists(SHARED_FOLDER):
     os.makedirs(SHARED_FOLDER)
@@ -129,26 +154,9 @@ def login():
 
     # Turnstile 驗證
     turnstile_token = data.get('cf-turnstile-response', '')
-    if TURNSTILE_SECRET_KEY:
-        if not turnstile_token:
-            return jsonify({'success': False, 'message': '請完成人機驗證'}), 400
-        try:
-            verify_res = http_requests.post(
-                'https://challenges.cloudflare.com/turnstile/v0/siteverify',
-                data={
-                    'secret': TURNSTILE_SECRET_KEY,
-                    'response': turnstile_token,
-                    'remoteip': request.remote_addr
-                },
-                timeout=10
-            )
-            verify_data = verify_res.json()
-            if not verify_data.get('success'):
-                logger.warning(f"Turnstile verification failed for user {username}: {verify_data}")
-                return jsonify({'success': False, 'message': '人機驗證失敗，請重試'}), 403
-        except Exception as e:
-            logger.error(f"Turnstile verification error: {e}")
-            return jsonify({'success': False, 'message': '驗證服務暫時無法使用，請稍後再試'}), 500
+    ok, err = verify_turnstile(turnstile_token, request.remote_addr, context=f'login:{username}')
+    if not ok:
+        return err
 
     try:
         success, message, cookies, student_no, token = GradeFetcher.login_and_get_tokens(username, data.get('password'))
@@ -262,6 +270,12 @@ def create_share_link():
         if not data:
             return jsonify({'error': 'No data provided'}), 400
 
+        # Turnstile 驗證
+        turnstile_token = data.pop('cf-turnstile-response', '')
+        ok, err = verify_turnstile(turnstile_token, request.remote_addr, context='share')
+        if not ok:
+            return err
+
         # Generate 15-char random URL-safe ID with special chars
         # Using A-Z, a-z, 0-9, -, _, ., ~
         chars = string.ascii_letters + string.digits + "-_.~"