[MKT_949]:feat/cloudflare turnstile integration

[jaaaaavier]

Changes

The purpose of this PR is to integrate Cloudflare Turnstile into the repo. To do this, we’ve done the following:

• Create the assertCaptcha file. Here, we basically decide whether to use the new verifyTurnstile function or the old verifyRecaptcha function. This allows us to keep what we already had and know works as a fallback
• In the verifyTurnstile file, we’ve set up everything needed to verify with Cloudflare that the token is correct. This file was created based on the official Cloudflare Turnstile documentation.
• I’ve also extracted the isTransientNetworkError method to the networkRetry file, since we’ll be using it in different parts of the code.
• In the checkout controller, we’ve replaced verifyRecaptcha with the asserCaptcha described above, marked captchaToken as optional, and added turnstileToken in the same way; now, one of these two must be required
• New variables have been added
• Tests have been updated

Test

Cloudflare publishes a set of dummy keys: public sitekey/secret pairs that force a deterministic
outcome (always pass, always fail, force an interactive challenge) while still going through the real
siteverify API. They let us exercise the whole chain — browser widget → drive-web → payments →
Cloudflare — without creating a widget in the dashboard.

Each scenario was run through a full checkout, checking three places: the request payload in the
browser, the payments logs, and the resulting HTTP status.

Scenario	Keys	Result
Happy path	sitekey 1x…BB (pass, invisible) + secret 1x…AA (pass)	POST /checkout/customer and POST /checkout/payment-intent both carry a turnstileToken alongside the reCAPTCHA captchaToken. No fallback warning in the logs. Payment completes.
Turnstile rejects the token	secret 2x…AA (always fails)	Turnstile rejected the token: invalid-input-response → 403, and reCAPTCHA is never consulted. responseTime: 60ms confirms no retries were attempted, i.e. the code was correctly treated as terminal rather than transient.
Widget fails in the browser	sitekey 2x…BB (always fails, invisible)	Console shows Turnstile error 600010; no turnstileToken in the payload; payment completes through reCAPTCHA.
Misconfigured sitekey	invalid sitekey	Widget never initialises, generateTurnstileToken() returns undefined, checkout is unaffected and falls back to reCAPTCHA.

I can add some images or video in the task if needed but i think we will need some QA

Notes

The enviroment variables required are:

TURNSTILE_ENDPOINT=https://challenges.cloudflare.com/turnstile/v0/siteverify
TURNSTILE_SECRET=the one used on ai-server

[sg-gs]

The markdown table format seems to not be correct @jaaaaavier

[sg-gs]

Please add the list of new environment variables in the PR's description @jaaaaavier

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
98.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sg-gs]

Adding the environment variables @jaaaaavier

[sg-gs]

Secrets updated @jaaaaavier

Turnstile Widget updated to consider drive.internxt.com also.

[github-actions]

⚠️ This pull request has been marked as stale due to 30 days of inactivity.

It will be automatically closed in 7 days if no further updates are made.