Alex Dunmow 7e9265c6a7 feat!: captcha via host-stamped X-Bn-Verified-Captcha; drop block/core entirely
SetCaptchaServer was .so-era injection — nothing wasm-side ever called
it, so the verifier was permanently nil and captcha-enabled booking
blocks failed closed on every submission. A guest can't hold the host's
stateful captcha server; the host now verifies+consumes the cap-token
before dispatch and stamps the unforgeable X-Bn-Verified-Captcha
trusted header (pluginsdk v0.2.2 auth.CaptchaVerified). Fail-closed
semantics preserved: no stamp = reject.

Deletes the last block/core import (captcha) and the test-side PoW
solver; go.mod no longer requires core.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-07 23:00:10 +08:00
2026-07-06 00:00:54 +08:00
Description
Cal.com Booking — embeddable booking calendar block for BlockNinja CMS with captcha, rate limiting, and webhook receiver (standalone wasm plugin)
3.9 MiB
Languages
Go 80.3%
templ 10.5%
TypeScript 9%
AMPL 0.1%