fix(contact): server-authoritative captcha + review fixes

waleedlatif1 · waleedlatif1 · commit fcdda4447b36 · 2026-07-01T00:50:48.000-07:00
- Make captcha server-authoritative: drop the client-trusted captchaUnavailable
  flag; a valid Turnstile token is the only way past the stricter fallback
  bucket, so callers can't opt out of the challenge
- Re-execute the Turnstile widget on every submit (incl. after expiry) instead
  of falling into the no-captcha path once the token expires
- Reset the pre-submit gate on mutation settle so rapid double-clicks can't fire
  a duplicate /api/contact request
- Map only feature_request to its email type; every other topic resolves to a
  General Inquiry confirmation so support requests aren't labeled bug reports
- Drop the confirmation-email promise from the success copy (it's best-effort)
- Collapse the duplicated no-captcha rate-limit branch; hoist shared response
  constants; read the Turnstile site key as a module constant
diff --git a/apps/sim/app/(landing)/contact/components/contact-form/contact-form.tsx b/apps/sim/app/(landing)/contact/components/contact-form/contact-form.tsx
@@ -23,6 +23,9 @@ import { useSubmitContact } from '@/hooks/queries/contact'
  */
 const FIELD_HEIGHT = 'h-[34px]'
 
+/** Build-time-inlined Turnstile site key; absent when captcha isn't configured. */
+const TURNSTILE_SITE_KEY = getEnv('NEXT_PUBLIC_TURNSTILE_SITE_KEY')
+
 type ContactField = keyof ContactRequestPayload
 type ContactErrors = Partial<Record<ContactField, string>>
 
@@ -105,8 +108,7 @@ export function ContactForm() {
   const [errors, setErrors] = useState<ContactErrors>({})
   const [isSubmitting, setIsSubmitting] = useState(false)
   const [website, setWebsite] = useState('')
-  const [widgetReady, setWidgetReady] = useState(false)
-  const [turnstileSiteKey] = useState(() => getEnv('NEXT_PUBLIC_TURNSTILE_SITE_KEY'))
+  const [widgetLoaded, setWidgetLoaded] = useState(false)
 
   function updateField<TField extends keyof ContactFormState>(
     field: TField,
@@ -142,26 +144,25 @@ export function ContactForm() {
       return
     }
 
+    // Best-effort Turnstile execution: re-run the (invisible) widget on every
+    // submit, including after an expiry, since reset + execute yields a fresh
+    // token. If the widget never loaded or execution fails, the token is omitted
+    // and the server applies its stricter no-captcha rate limit.
     let captchaToken: string | undefined
-    let captchaUnavailable: boolean | undefined
     const widget = turnstileRef.current
 
-    if (turnstileSiteKey) {
-      if (widgetReady && widget) {
-        try {
-          widget.reset()
-          widget.execute()
-          captchaToken = await widget.getResponsePromise(30_000)
-        } catch {
-          captchaUnavailable = true
-        }
-      } else {
-        captchaUnavailable = true
+    if (TURNSTILE_SITE_KEY && widgetLoaded && widget) {
+      try {
+        widget.reset()
+        widget.execute()
+        captchaToken = await widget.getResponsePromise(30_000)
+      } catch {
+        captchaToken = undefined
       }
     }
 
     contactMutation.mutate(
-      { ...parsed.data, website, captchaToken, captchaUnavailable },
+      { ...parsed.data, website, captchaToken },
       {
         onSuccess: () => {
           captureClientEvent('landing_contact_submitted', { topic: parsed.data.topic })
@@ -171,9 +172,14 @@ export function ContactForm() {
         onError: () => {
           turnstileRef.current?.reset()
         },
+        // Reset the pre-submit gate only once the mutation settles, so `isBusy`
+        // stays true continuously (the captcha window then `isPending`) and a
+        // second click can never slip through to fire a duplicate request.
+        onSettled: () => {
+          setIsSubmitting(false)
+        },
       }
     )
-    setIsSubmitting(false)
   }
 
   const isBusy = contactMutation.isPending || isSubmitting
@@ -190,8 +196,7 @@ export function ContactForm() {
         </div>
         <h2 className='mt-5 text-[var(--text-primary)] text-xl leading-[1.2]'>Message received</h2>
         <p className='mt-2 max-w-sm text-[var(--text-muted)] text-sm leading-[1.6]'>
-          Thanks for reaching out. We've sent a confirmation to your inbox and will get back to you
-          shortly.
+          Thanks for reaching out. Our team will get back to you shortly.
         </p>
         <button
           type='button'
@@ -311,15 +316,14 @@ export function ContactForm() {
           />
         </ContactField>
 
-        {turnstileSiteKey ? (
+        {TURNSTILE_SITE_KEY ? (
           <Turnstile
             ref={turnstileRef}
-            siteKey={turnstileSiteKey}
+            siteKey={TURNSTILE_SITE_KEY}
             options={{ execution: 'execute', appearance: 'execute', size: 'invisible' }}
-            onWidgetLoad={() => setWidgetReady(true)}
-            onExpire={() => setWidgetReady(false)}
-            onError={() => setWidgetReady(false)}
-            onUnsupported={() => setWidgetReady(false)}
+            onWidgetLoad={() => setWidgetLoaded(true)}
+            onError={() => setWidgetLoaded(false)}
+            onUnsupported={() => setWidgetLoaded(false)}
           />
         ) : null}
 
diff --git a/apps/sim/app/api/contact/route.ts b/apps/sim/app/api/contact/route.ts
@@ -34,6 +34,7 @@ const CAPTCHA_UNAVAILABLE_RATE_LIMIT: TokenBucketConfig = {
 }
 
 const SUCCESS_RESPONSE = { success: true, message: "Thanks — we'll be in touch soon." }
+const TOO_MANY_REQUESTS_RESPONSE = { error: 'Too many requests. Please try again later.' }
 
 export const POST = withRouteHandler(async (req: NextRequest) => {
   const requestId = generateRequestId()
@@ -49,13 +50,10 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
 
     if (!allowed) {
       logger.warn(`[${requestId}] Rate limit exceeded for IP ${ip}`, { remaining, resetAt })
-      return NextResponse.json(
-        { error: 'Too many requests. Please try again later.' },
-        {
-          status: 429,
-          headers: { 'Retry-After': String(Math.ceil((resetAt.getTime() - Date.now()) / 1000)) },
-        }
-      )
+      return NextResponse.json(TOO_MANY_REQUESTS_RESPONSE, {
+        status: 429,
+        headers: { 'Retry-After': String(Math.ceil((resetAt.getTime() - Date.now()) / 1000)) },
+      })
     }
 
     const parsed = await parseRequest(submitContactContract, req, {})
@@ -72,56 +70,51 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       return NextResponse.json(SUCCESS_RESPONSE, { status: 201 })
     }
 
-    const captchaUnavailable = parsed.data.body.captchaUnavailable === true
-
-    if (captchaUnavailable) {
-      const nocaptchaKey = `public:contact:nocaptcha:${ip}`
-      const { allowed: nocaptchaAllowed } = await rateLimiter.checkRateLimitDirect(
-        nocaptchaKey,
-        CAPTCHA_UNAVAILABLE_RATE_LIMIT
-      )
-      if (!nocaptchaAllowed) {
-        logger.warn(`[${requestId}] Rate limit exceeded (no-captcha) for IP ${ip}`)
-        return NextResponse.json(
-          { error: 'Too many requests. Please try again later.' },
-          { status: 429 }
-        )
+    // Captcha is server-authoritative: a valid Turnstile token is the only way to
+    // skip the stricter fallback bucket. A missing token (widget could not load) or
+    // a Cloudflare transport error falls back to the tighter no-captcha rate limit
+    // rather than a free pass, so callers cannot opt out of the challenge. An
+    // outright invalid token is rejected.
+    if (isTurnstileConfigured()) {
+      let captchaVerified = false
+      const token =
+        typeof captchaToken === 'string' && captchaToken.length > 0 ? captchaToken : null
+
+      if (token) {
+        const verification = await verifyTurnstileToken({
+          token,
+          remoteIp: ip,
+          expectedHostname: SITE_HOSTNAME,
+        })
+        if (verification.success) {
+          captchaVerified = true
+        } else if (!verification.transportError) {
+          logger.warn(`[${requestId}] Captcha verification failed`, {
+            ip,
+            errorCodes: verification.errorCodes,
+          })
+          return NextResponse.json(
+            { error: 'Captcha verification failed. Please try again.' },
+            { status: 400 }
+          )
+        } else {
+          logger.warn(
+            `[${requestId}] Captcha transport error, falling back to no-captcha rate limit`,
+            { ip }
+          )
+        }
       }
-    }
 
-    if (isTurnstileConfigured() && !captchaUnavailable) {
-      const token = typeof captchaToken === 'string' ? captchaToken : null
-      const verification = await verifyTurnstileToken({
-        token,
-        remoteIp: ip,
-        expectedHostname: SITE_HOSTNAME,
-      })
-      if (!verification.success && verification.transportError) {
-        logger.warn(
-          `[${requestId}] Captcha transport error, falling back to no-captcha rate limit`,
-          { ip }
-        )
+      if (!captchaVerified) {
         const nocaptchaKey = `public:contact:nocaptcha:${ip}`
         const { allowed: nocaptchaAllowed } = await rateLimiter.checkRateLimitDirect(
           nocaptchaKey,
           CAPTCHA_UNAVAILABLE_RATE_LIMIT
         )
         if (!nocaptchaAllowed) {
-          logger.warn(`[${requestId}] Rate limit exceeded (transport-error fallback) for IP ${ip}`)
-          return NextResponse.json(
-            { error: 'Too many requests. Please try again later.' },
-            { status: 429 }
-          )
+          logger.warn(`[${requestId}] Rate limit exceeded (no-captcha) for IP ${ip}`)
+          return NextResponse.json(TOO_MANY_REQUESTS_RESPONSE, { status: 429 })
         }
-      } else if (!verification.success) {
-        logger.warn(`[${requestId}] Captcha verification failed`, {
-          ip,
-          errorCodes: verification.errorCodes,
-        })
-        return NextResponse.json(
-          { error: 'Captcha verification failed. Please try again.' },
-          { status: 400 }
-        )
       }
     }
 
diff --git a/apps/sim/lib/api/contracts/contact.ts b/apps/sim/lib/api/contracts/contact.ts
@@ -68,7 +68,6 @@ export type ContactRequestBody = z.input<typeof contactRequestSchema>
 export const submitContactBodySchema = contactRequestSchema.extend({
   website: z.string().optional(),
   captchaToken: z.string().optional(),
-  captchaUnavailable: z.boolean().optional(),
 })
 
 export function getContactTopicLabel(value: ContactRequestPayload['topic']): string {
@@ -77,17 +76,14 @@ export function getContactTopicLabel(value: ContactRequestPayload['topic']): str
 
 export type HelpEmailType = 'bug' | 'feedback' | 'feature_request' | 'other'
 
+/**
+ * Map a contact topic to the confirmation-email type. Only `feature_request` has
+ * a matching email label ("Feature Request"); every other topic — support, sales,
+ * billing, etc. — resolves to `other` ("General Inquiry") so the confirmation copy
+ * never mislabels the request (e.g. calling a support inquiry a "bug report").
+ */
 export function mapContactTopicToHelpType(topic: ContactRequestPayload['topic']): HelpEmailType {
-  switch (topic) {
-    case 'feature_request':
-      return 'feature_request'
-    case 'support':
-      return 'bug'
-    case 'integration':
-      return 'feedback'
-    default:
-      return 'other'
-  }
+  return topic === 'feature_request' ? 'feature_request' : 'other'
 }
 
 export const contactResponseSchema = z.object({
