Setup cloudflare turnstile support

[devksingh4]

Summary by CodeRabbit

Release Notes

• New Features

  • Added security verification (Turnstile) to purchase and checkout flows for enhanced protection.

• Chores

  • Updated API base URL configuration across the application.
  • Enhanced build process with environment-specific build scripts for improved deployment workflow.
  • Added new dependency for security verification integration.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The PR updates environment configurations to replace the events API base URL with a core API base URL across all environment files (.env.development, .env.staging, .env.prod). It introduces Turnstile CAPTCHA integration by adding the NEXT_PUBLIC_TURNSTILE_SITE_KEY variable and a new npm dependency (@marsidev/react-turnstile). The build system is refactored to use environment-specific build scripts (build:dev, build:prod, build:staging) via env-cmd, with a postbuild step to copy redirect files. The deployment workflow is updated to conditionally run the appropriate build script based on the git branch. Source files are updated to reference the new core API base URL constant, and the merch page implements Turnstile token validation in the checkout flow.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly describes the main change: adding Cloudflare Turnstile support. The pull request introduces Turnstile integration across multiple components, adds the Turnstile dependency, configures environment variables, and implements token-based security flows throughout the codebase.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Deploying with Cloudflare Pages

Name	Result
Last commit:	7fcb235
Preview URL:	https://fd5b6637.acmuiuc.pages.dev
Branch Preview URL:	https://dsingh14-cf-turnstile.acmuiuc.pages.dev

[coderabbitai]

Actionable comments posted: 3

🤖 Fix all issues with AI agents

In `@package.json`:
- Line 21: The dependency "@marsidev/react-turnstile": "^1.4.1" is unmaintained
and may be incompatible with current React; either verify compatibility or
replace it: confirm by running the app build and test suite against your current
React version and check for runtime warnings in components that import this
package (search for imports of "@marsidev/react-turnstile"); if
incompatibilities or security concerns are found, replace the entry in
package.json with a maintained alternative (for example the official Cloudflare
wrapper or another actively maintained package), update any import paths and
component usage to the new package's API (adjust props/handlers in components
that reference the old package), then reinstall dependencies and run full
CI/tests to ensure no regressions.

In `@src/app/`(membership)/admin/sync/page.tsx:
- Line 33: Remove the unused constant baseUrl declared as `const baseUrl =
process.env.NEXT_PUBLIC_CORE_API_BASE_URL;` since it is never referenced; simply
delete that line and ensure any API calls use the existing `syncIdentity` import
from `@/utils/api` (which handles its own base URL) so no other changes are
required.

In `@src/app/`(membership)/merch/page.tsx:
- Line 69: The Turnstile widget currently only uses onSuccess={setToken},
leaving a stale token when the widget expires or errors; update each Turnstile
usage to add onExpire and onError handlers that clear the token (call
setToken(undefined) or setToken('')) so the component state resets and users can
retry verification; look for the Turnstile components in this file (and other
occurrences of the token state and setToken) and attach onExpire={() =>
setToken(undefined)} and onError={() => setToken(undefined)} alongside the
existing onSuccess handler.