Code Review Findings

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Register Problem Matchers
         uses: r7kamura/rust-problem-matchers@v1
@@ -49,4 +49,4 @@ jobs:
         run: cargo build --release --all-features
 
       - name: Run Unit Tests
-        run: cargo make test
+        run: cargo make test-ci

Cargo.toml

@@ -1,28 +1,44 @@
 [package]
 name = "cf-turnstile"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2021"
 description = "A Rust client for Cloudflare Turnstile"
 homepage = "https://github.com/sycertech/cf-turnstile"
 repository = "https://github.com/sycertech/cf-turnstile"
 categories = ["api-bindings", "asynchronous", "web-programming::http-client"]
-keywords = ["cloduflare", "turnstile", "recaptcha", "captcha"]
+keywords = ["cloudflare", "turnstile", "recaptcha", "captcha"]
 license = "MIT"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-http-body-util = { default-features = false, version = "0.1" }
-hyper = { default-features = false, version = "1" }
-hyper-util = { default-features = false, features = ["client-legacy", "http1", "http2", "tokio"], version = "0.1.20" }
-hyper-rustls = { default-features = false, optional = true, features = ["http1", "http2", "ring"], version = "0.27.9" }
-hyper-tls = { default-features = false, optional = true, features = ["alpn"], version = "0.6" }
-hyper-hickory = { default-features = false, optional = true, version = "0.8.0" }
+bytes = { version = "1.12.1", default-features = false }
+http-body-util = { version = "0.1.4", default-features = false }
+hyper = { version = "1.11.0", default-features = false }
+hyper-util = { version = "0.1.20", default-features = false, features = [
+  "client-legacy",
+  "http1",
+  "http2",
+  "tokio",
+] }
+hyper-rustls = { version = "0.27.9", optional = true, default-features = false, features = [
+  "http1",
+  "http2",
+  "ring",
+] }
+hyper-tls = { version = "0.6.0", optional = true, default-features = false, features = [
+  "alpn",
+] }
+hyper-hickory = { version = "0.8.0", optional = true, default-features = false }
 secrecy = "0.10.3"
-serde = { default-features = false, features = ["derive"], version = "1" }
-serde_json = { default-features = false, features = ["std"], version = "1" }
-thiserror = "2"
-uuid = { version = "1", features = ["v4", "serde"], optional = true }
+serde = { version = "1.0.229", default-features = false, features = [
+  "derive",
+  "std",
+] }
+serde_json = { version = "1.0.151", features = ["std"] }
+thiserror = "2.0.19"
+uuid = { version = "1.24.0", optional = true, features = ["v4", "serde"] }
+zeroize = "1.9.0"
 
 [features]
 default = ["rustls-native-roots", "hickory"]
@@ -32,6 +48,24 @@ rustls-native-roots = ["dep:hyper-rustls", "hyper-rustls?/native-tokio"]
 rustls-webpki-roots = ["dep:hyper-rustls", "hyper-rustls?/webpki-tokio"]
 hickory = ["dep:hyper-hickory", "hyper-hickory?/tokio"]
 integration = ["idempotency"]
+# Tests that call the live Turnstile API with Cloudflare's dummy keys. Off by
+# default so `cargo test` works offline; `cargo make test` enables it.
+network-tests = []
 
 [dev-dependencies]
-tokio = { version = "1", default-features = false, features = ["rt-multi-thread", "test-util", "macros"] }
+tokio = { version = "1", default-features = false, features = [
+  "rt-multi-thread",
+  "test-util",
+  "macros",
+  # Used only by the timeout example in `siteverify`'s docs.
+  "time",
+] }
+
+[lints.rust]
+unsafe_code = "forbid"
+missing_docs = "warn"
+
+[lints.clippy]
+all = "deny"
+pedantic = { level = "deny", priority = -1 }
+nursery = { level = "deny", priority = -1 }

Makefile.toml

@@ -11,26 +11,20 @@ script = '''
 [tasks.lint]
 install_crate = "clippy"
 command = "cargo"
-args = [
-    "clippy",
-    "--tests",
-    "--examples",
-    "--all-targets",
-    "--all-features",
-]
+args = ["clippy", "--tests", "--examples", "--all-targets", "--all-features"]
 
 [tasks.lint-ci]
 install_crate = "clippy"
 command = "cargo"
 args = [
-    "clippy",
-    "--tests",
-    "--examples",
-    "--all-targets",
-    "--all-features",
-    "--",
-    "-D",
-    "warnings",
+  "clippy",
+  "--tests",
+  "--examples",
+  "--all-targets",
+  "--all-features",
+  "--",
+  "-D",
+  "warnings",
 ]
 
 [tasks.format]
@@ -50,46 +44,30 @@ args = ["fmt", "--all", "--", "--check"]
 [tasks.test]
 env = { "RUN_MODE" = "test", "RUST_LOG" = "info" }
 command = "cargo"
-args = ["nextest", "run", "${@}"]
+args = ["nextest", "run", "--features", "network-tests", "${@}"]
 
 [tasks.test-ci]
 env = { "RUN_MODE" = "ci", "RUST_LOG" = "info" }
 command = "cargo"
-args = ["nextest", "run"]
+args = ["nextest", "run", "--features", "network-tests"]
 
 [tasks.cov]
 command = "cargo"
 env = { "RUN_MODE" = "test" }
-args = [
-    "llvm-cov", "nextest",
-    "${@}"
-]
+args = ["llvm-cov", "nextest", "${@}"]
 
 [tasks.cov-ci]
 command = "cargo"
 env = { "RUN_MODE" = "ci" }
-args = [
-    "llvm-cov", "nextest",
-    "--lcov", "--output-path", "lcov.info"
-]
+args = ["llvm-cov", "nextest", "--lcov", "--output-path", "lcov.info"]
 
 [tasks.docs]
 command = "cargo"
-args = [
-    "doc",
-    "--no-deps",
-    "--all-features",
-    "--document-private-items",
-]
+args = ["doc", "--no-deps", "--all-features", "--document-private-items"]
 
 [tasks.docs-watch]
 command = "cargo"
-args = [
-    "doc",
-    "--no-deps",
-    "--all-features",
-    "--document-private-items",
-]
+args = ["doc", "--no-deps", "--all-features", "--document-private-items"]
 watch = true
 
 [tasks.timings]

README.md

@@ -1,23 +1,31 @@
 > [!NOTE]
-> This is an actively maintained frok of https://github.com/Fyko/cf-turnstile
+> This is an actively maintained fork of <https://github.com/Fyko/cf-turnstile>
 
 # cf-turnstile
 
 A Rust client for [Cloudflare Turnstile].
 
 
 # Example
-```rust,ignore
+```rust,no_run
 use cf_turnstile::{SiteVerifyRequest, TurnstileClient};
 
-let client = TurnstileClient::new("my-secret".to_string().into());
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let client = TurnstileClient::new("my-secret".to_string().into());
 
-let validated = client.siteverify(SiteVerifyRequest {
-   response: "myresponse".to_string(),
-  ..Default::default()
-}).await?;
+    let validated = client
+        .siteverify(SiteVerifyRequest {
+            response: "myresponse".to_string(),
+            ..Default::default()
+        })
+        .await?;
 
-assert!(validated.success);
+    // `siteverify` returns `Err` unless Cloudflare verified the token.
+    println!("verified on {}", validated.hostname);
+
+    Ok(())
+}
 ```
 
 ## Features
@@ -30,23 +38,32 @@ This will enable the `idempotency_key` field on the [`SiteVerifyRequest`](struct
 
 ### TLS
 
-**Note**: not enabling any TLS feature is supported for use behind a proxy;
-Turnstile's API is HTTPS only.
+**Note**: Turnstile's API is HTTPS only, so at least one TLS feature must be enabled.
+Building without a TLS backend is a compile error.
 
 **Note**: this TLS code was taken from [twilight-http](https://github.com/twilight-rs/twilight/tree/main/twilight-http) in accordance with its license.
 
-`cf-turnstile` has features to enable HTTPS connectivity with [`hyper`]. These
-features are mutually exclusive. `rustls-native-roots` is enabled by default.
+`cf-turnstile` has features to enable HTTPS connectivity with [`hyper`].
+`rustls-native-roots` is enabled by default.
+
+Enabling more than one backend is allowed rather than a build failure: Cargo features
+are additive, so two unrelated crates in the same dependency graph may each select a
+different backend, and that combination has to keep compiling. When several are
+enabled the backend is chosen by precedence:
 
-#### `native`
+1. `rustls-native-roots`
+2. `rustls-webpki-roots`
+3. `native-tls`
 
-The `native` feature uses a HTTPS connector provided by [`hyper-tls`].
+#### `native-tls`
 
-To enable `native`, do something like this in your `Cargo.toml`:
+The `native-tls` feature uses a HTTPS connector provided by [`hyper-tls`].
+
+To enable `native-tls`, do something like this in your `Cargo.toml`:
 
 ```toml
 [dependencies]
-cf-turnstile = { default-features = false, features = ["native"], version = "0.1" }
+cf-turnstile = { default-features = false, features = ["native-tls", "hickory"], version = "0.3" }
 ```
 
 #### `rustls-native-roots`
@@ -65,17 +82,20 @@ for root certificates.
 
 This should be preferred over `rustls-native-roots` in Docker containers based on `scratch`.
 
-### Trust-DNS
+### Hickory DNS
 
-The `trust-dns` enables [`hyper-trust-dns`], which replaces the default
-`GaiResolver` in [`hyper`]. [`hyper-trust-dns`] instead provides a fully
+The `hickory` feature enables [`hyper-hickory`], which replaces the default
+`GaiResolver` in [`hyper`]. [`hyper-hickory`] instead provides a fully
 async DNS resolver on the application level.
 
+This is enabled by default. Note that `default-features = false` turns it off, so
+add it back explicitly if you want it alongside a non-default TLS backend.
+
 [Cloudflare Turnstile]: https://developers.cloudflare.com/turnstile/
 [`hyper`]: https://crates.io/crates/hyper
 [`hyper-rustls`]: https://crates.io/crates/hyper-rustls
 [`hyper-tls`]: https://crates.io/crates/hyper-tls
 [`rustls`]: https://crates.io/crates/rustls
 [`rustls-native-certs`]: https://crates.io/crates/rustls-native-certs
-[`hyper-trust-dns`]: https://crates.io/crates/hyper-trust-dns
+[`hyper-hickory`]: https://crates.io/crates/hyper-hickory
 [`webpki-roots`]: https://crates.io/crates/webpki-roots