New Captcha Package added

examples/captcha-showcase/app/api/page-grant.ts

@@ -0,0 +1,34 @@
+import type { Context } from "@wrnexus/core";
+
+function safeReturnPath(value: string | null, baseUrl: URL): string {
+  if (!value) return "/protected";
+
+  try {
+    const destination = new URL(value, baseUrl);
+    if (destination.origin !== baseUrl.origin) return "/protected";
+    if (!destination.pathname.startsWith("/") || destination.pathname.startsWith("//")) {
+      return "/protected";
+    }
+    return `${destination.pathname}${destination.search}`;
+  } catch {
+    return "/protected";
+  }
+}
+
+export async function POST(ctx: Context): Promise<Response> {
+  const contentType = ctx.req.headers.get("content-type") ?? "";
+  let submittedReturnTo: string | null = null;
+
+  if (contentType.includes("application/json")) {
+    const body = (await ctx.req.json().catch(() => ({}))) as Record<string, unknown>;
+    submittedReturnTo = typeof body.returnTo === "string" ? body.returnTo : null;
+  } else {
+    const form = await ctx.req.formData();
+    const value = form.get("returnTo");
+    submittedReturnTo = typeof value === "string" ? value : null;
+  }
+
+  const returnTo = submittedReturnTo ?? ctx.url.searchParams.get("returnTo");
+  const safePath = safeReturnPath(returnTo, ctx.url);
+  return Response.redirect(new URL(safePath, ctx.url), 303);
+}