add cloudflare turnstile verification endpoint (#78)

Author: hsunami10

.env.example

@@ -19,4 +19,7 @@ export FIREBASE_CLIENT_X509_CERT_URL=''
 
 # Skip token authentication on endpoints.
 export SKIP_TOKEN_AUTH_HEADER=''
-export SKIP_TOKEN_AUTH_KEY=''
+export SKIP_TOKEN_AUTH_KEY=''
+
+# Cloudflare Turnstile Config
+export CLOUDFLARE_TURNSTILE_SECRET_KEY=''

server/server.py

@@ -14,6 +14,7 @@
 from functools import wraps
 from datadog import initialize, statsd
 import logging
+import requests
 
 import boto3.data
 from onchain.pools.protocol import ProtocolRegistry
@@ -155,6 +156,39 @@ def handle_generic_error(e):
 
             return jsonify({"error": str(e)}), 500
 
+    @app.route("/api/cloudflare/turnstile/v0/siteverify", methods=["POST"])
+    def verify_cloudflare_turnstile_token():
+        try:
+            secret_key = os.getenv("CLOUDFLARE_TURNSTILE_SECRET_KEY")
+            if not secret_key:
+                raise Exception("CLOUDFLARE_TURNSTILE_SECRET_KEY environment variable is not set")
+
+            data = request.get_json()
+            token = data.get('token')
+
+            if not token:
+                return jsonify({"error": "Missing token"}), 400
+
+            # Make the request to Cloudflare Turnstile
+            response = requests.post(
+                'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+                data={
+                    'secret': secret_key,
+                    'response': token
+                },
+                headers={
+                    'content-type': 'application/x-www-form-urlencoded'
+                }
+            )
+
+            result = response.json()
+            status_code = 200 if result.get('success') else 400
+            return jsonify(result), status_code
+
+        except Exception as e:
+            logging.error(f"Error verifying Cloudflare Turnstile token: {e}")
+            return jsonify({"error": "Internal server error"}), 500
+
     @app.route("/api/verify/solana", methods=["POST"])
     def verify_solana_signature():
         try: