Turnstile and OTS update

src/components/professional/ContactForm.tsx

@@ -131,18 +131,8 @@ export default function ContactForm({ turnstileSiteKey }: Props) {
         // widget rapidly flashing. Instead we leave the widget in its errored
         // state; the next form submission will reset it for a fresh attempt.
         // The error surfaces as the token being empty, which onSubmit reports.
-        'error-callback': (error: unknown) => {
+        'error-callback': () => {
           turnstileTokenRef.current = '';
-          // TEMPORARY DIAGNOSTIC: Turnstile passes an error code/string when the
-          // widget fails its challenge (e.g. "110200-domain-not-authorized",
-          // "300030-..."). The 400 on challenges.cloudflare.com/cdn-cgi/
-          // challenge-platform/... originates here. Log it so the browser
-          // console shows the exact reason. Remove once resolved.
-          console.warn('[contact] turnstile widget error:', error, {
-            sitekey: turnstileSiteKey,
-            origin: location.origin,
-            hostname: location.hostname,
-          });
         },
         theme: 'dark',
       },

src/middleware.ts

@@ -31,10 +31,9 @@
  *     need the origin. (SRI is intentionally NOT applied to the Turnstile
  *     loader — see ContactForm.tsx for why.)
  *
- * Fonts: Fontsource variable fonts (woff2) are self-hosted, but Vite inlines
- * font subsets below build.assetsInlineLimit (default 4096 bytes) as
- * data:font/woff2 base64 URIs. At least two small cyrillic-ext subsets fall
- * under that threshold, so font-src MUST include data: or they are blocked.
+ * Fonts: Fontsource variable fonts (woff2) are self-hosted and emitted as
+ * real files (Vite's assetsInlineLimit is set to 0 in astro.config.mjs so no
+ * subset is inlined as a data URI), so font-src can stay 'self'.
  *
  * Images: board-game covers are self-hosted (fetched at build time by
  * scripts/fetch-bgg-covers.mjs) and the hero portrait is local, but TCG deck
@@ -67,10 +66,9 @@ const CONTENT_SECURITY_POLICY = [
   // storage.googleapis.com origin serves TCG deck featured-card art hotlinked
   // from Archidekt's card-image bucket (see src/lib/archidekt.ts).
   "img-src 'self' data: https://storage.googleapis.com",
-  // Self-hosted variable fonts (woff2) via @fontsource-variable. data: is
-  // required because Vite inlines font subsets under assetsInlineLimit as
-  // data:font/woff2 base64 URIs.
-  "font-src 'self' data:",
+  // Self-hosted variable fonts (woff2) via @fontsource-variable, emitted as
+  // real files (assetsInlineLimit: 0 — see astro.config.mjs).
+  "font-src 'self'",
   // Same-origin fetch/XHR (the contact form POSTs to /api/contact) plus the
   // Turnstile siteverify calls the widget makes from the browser.
   "connect-src 'self' https://challenges.cloudflare.com",

src/pages/api/contact.ts

@@ -94,17 +94,7 @@ async function verifyTurnstile(token: string | undefined, ip: string): Promise<b
       method: 'POST',
       body: form,
     });
-    const data = (await res.json()) as { success: boolean; 'error-codes'?: string[] };
-    // TEMPORARY DIAGNOSTIC: Cloudflare returns HTTP 200 even on failure, with the
-    // reason in error-codes (e.g. "invalid-input-secret", "invalid-input-response",
-    // "timeout-or-duplicate"). Log it so we can see why verification is failing.
-    // Remove this log once the Turnstile issue is resolved.
-    if (!data.success) {
-      console.warn('[contact] turnstile siteverify failed:', {
-        status: res.status,
-        errorCodes: data['error-codes'] ?? [],
-      });
-    }
+    const data = (await res.json()) as { success: boolean };
     return Boolean(data.success);
   } catch (err) {
     // Network error talking to Cloudflare. Fail closed: reject the submission