Add Cloudflare Turnstile to OSA Worker

[neuromechanist]

Summary

Enable Turnstile bot protection on the OSA Cloudflare Worker. Currently disabled (no secret configured).

Steps

1. Go to Cloudflare Dashboard → Turnstile
2. Create new widget with Visible mode
3. Add allowed hostnames:
   • hedtags.org
   • hed-examples.org
   • osc.earth
   • localhost
4. Copy the Site Key (for frontend integration)
5. Copy the Secret Key and set it:

   cd workers/osa-worker
   bunx wrangler secret put TURNSTILE_SECRET_KEY

Frontend Integration

Add to any frontend that calls the worker:

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<div id="turnstile-container"></div>

<script>
turnstile.render('#turnstile-container', {
  sitekey: 'YOUR_SITE_KEY',
  callback: function(token) {
    // Include token in API requests as cf_turnstile_response
  }
});
</script>

References

• Worker: workers/osa-worker/
• Docs: .context/security-architecture.md
• Worker URL: https://osa-worker.shirazi-10f.workers.dev/