bot_challenge_page 0.10.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb4f4b1a29eae8a320d95d2279e21ab44ef8168be416136790c96d2150de1ac3
-  data.tar.gz: fa8fe854808413b95c4e2c4a5c4ecf4ed7b3826f77b487d46aee895f9a2d6735
+  metadata.gz: 3630f38384be644c246e841ca6d582b1e942b232ae46f5917eef1dbd2f65c288
+  data.tar.gz: 1e74969897aaa0fecc0bce2498c4abedf0049655f98ff5db07eb77c503e924ba
 SHA512:
-  metadata.gz: '082b26cdef3709185fb7616d009798c26d244485ccb03e24593512f1af6481450413351356f044e380e953f65e28a6ac386ca490ba778fbea78c71109f2dc98d'
-  data.tar.gz: 805a64dfc7de28b6f27fdf0c4b64b18cba29e98ae59376bce6565e133b993246b3783312f65ad69d9c65df8ea31a4193f0dbe2cd5cb4006ca81264caa60464c7
+  metadata.gz: 20e0594a23e03d59a1655136713f1a5cdccd6de8f644e41f300644eada64442d58855da93a907609c711092f407e9fb2d835dba2f635b5b07af3f6874857c24a
+  data.tar.gz: '03358909eb4c97a61a558e93a55b736cb91ddee70d9892765f3b00877acc5ef6a1ef725dfbd669b2ff7d9e31b6e629f62423028ca94d346795f98a1df8db646d'

data/README.md

@@ -31,7 +31,7 @@ The motivating use case is fairly dumb (probably AI-related) crawlers crawling s
 * Configure in the generated `./config/initializers/bot_challenge_page.rb`
   * At a minimum you need to configure your Cloudflare Turnstile keys
 
-  * Some other configuration options are offered -- more advanced/specialized ones are available that are not mentioned in generated config file, see [Config class](./app/models/bot_challenge_page/config.rb)
+  * Some other configuration options are offered -- more advanced/specialized ones are available that are not mentioned in generated config file, see [Config class](./lib/bot_challenge_page/config.rb)
 
 ## Protect some paths
 
@@ -39,15 +39,15 @@ You can add `bot_challenge` to a controller to protect all actions in that contr
 
 You can also use all the Rails `before_action` params to apply to only some actions or requests in that controller: `only` and `except` to specify actions; and `if` and `unless` to specify procs to filter individual requests.
 
-    * Note that we can only protect GET paths, and also think about making sure you DON'T protect
-      any path your front-end needs JS `fetch` access to, as this would block it (at least
-      without custom front-end code we haven't really explored)
+  * Note that we can only protect GET paths, and also think about making sure you DON'T protect
+    any path your front-end needs JS `fetch` access to, as this would block it (at least
+    without custom front-end code we haven't really explored)
 
-    * If you are tempted to just protect `/` that may work, but you may need to exclude hearbeat paths, front-end (AJAX) requestable paths, API endpoints, uptime checker requests, or other machine-access-desired paths. These may be good candidates for an `unless` parameter, or the `skip_when` configuration.
+  * If you are tempted to just protect `/` that may work, but you may need to exclude hearbeat paths, front-end (AJAX) requestable paths, API endpoints, uptime checker requests, or other machine-access-desired paths. These may be good candidates for an `unless` parameter, or the `skip_when` configuration.
 
-    * The author is a librarian who believes maintaining machine access in general is a public good, and tries to limit access with a bot challenge to the minimum paths necessary for app sustainability.
+  * The author is a librarian who believes maintaining machine access in general is a public good, and tries to limit access with a bot challenge to the minimum paths necessary for app sustainability.
 
-    * The default configuration only allows re-use of a 'pass' cookie from requests with same IP address subnet and user-agent-related headers. This can be customized.
+  * The default configuration only allows re-use of a 'pass' cookie from requests with same IP address subnet and user-agent-related headers. This can be customized.
 
 ```ruby
 class WidgetController < ApplicationController
@@ -92,7 +92,7 @@ The challenge page by default will be displayed in your app's default rails `lay
 To customize the layout or challenge page HTML more further, you can use configuration to supply a `render` method for the controller pointing to your own templates or other layouts. You will probably want to re-use the partials we use in our default template, for standard functionality. And you'll want to provide `<template>` elements with the same id's for those elements, but can put whatever you want inside the templates!
 
 ```ruby
-BotChallengePage::BotChallengePageController.bot_challenge_config.challenge_renderer = ()->  {
+config.challenge_renderer = ()->  {
   render "my_local_view_folder/whatever", layout "another_layout"
 }
 ```
@@ -107,7 +107,7 @@ If you'd like to log or observe challenge issues, you can configure a proc that
 in the context of the controller, and is called when a page is blocked by a challenge.
 
 ```ruby
-BotChallengePage::BotChallengePageController.bot_challenge_config.after_blocked = (_bot_challenge_class)->  {
+config.after_blocked = (_bot_challenge_class)->  {
   logger.info("page blocked by challenge: #{request.uri}")
 }
 ```
@@ -115,7 +115,7 @@ BotChallengePage::BotChallengePageController.bot_challenge_config.after_blocked
 Or, here's how I managed to get it in [lograge](https://github.com/roidrage/lograge), so a page blocked results in a `bot_chlng=true` param in a lograge line.
 
 ```ruby
-BotChallengePage::BotChallengePageController.bot_challenge_config.after_blocked =
+config.after_blocked =
   ->(bot_detect_class) {
     request.env["bot_detect.blocked_for_challenge"] = true
   }
@@ -129,6 +129,8 @@ config.lograge.custom_payload do |controller|
 end
 ```
 
+Later, however, using similar mechanism, I actually suppressed logging of actions that resulted in bot challenges altogether -- they were exhausting my log platform quota.
+
 ## Example possible Blacklight config
 
 Many of us in my professional community use [blacklight](https://github.com/projectblacklight/blacklight).  Here's a possible sample blacklight config to:
@@ -143,18 +145,18 @@ Many of us in my professional community use [blacklight](https://github.com/proj
 
 ```ruby
 # ./config/initializers/bot_challenge_page.rb
-Rails.application.config.to_prepare do
-  BotChallengePage::BotChallengePageController.bot_challenge_config.enabled = true
+BotChanngePage.configure do
+  config.enabled = true
 
   # Need to set store to a Rails cache store other than null store, if you want to track
-  # rate limits.
-  BotChallengePage::BotChallengePageController.bot_challenge_config.store = :redis_store
+  # rate limits.  We chooes to use a different store than Rails.cache.
+  config.store = ActiveSupport::Cache::RedisCacheStore.new(url: $some_redis_url)
 
   # Get from CloudFlare Turnstile: https://www.cloudflare.com/application-services/products/turnstile/
-  BotChallengePage::BotChallengePageController.bot_challenge_config.cf_turnstile_sitekey = "MUST GET"
-  BotChallengePage::BotChallengePageController.bot_challenge_config.cf_turnstile_secret_key = "MUST GET"
+  config.cf_turnstile_sitekey = "MUST GET"
+  config.cf_turnstile_secret_key = "MUST GET"
 
-  BotChallengePage::BotChallengePageController.bot_challenge_config.skip_when = ->(config) {
+  config.skip_when = ->(config) {
     # Exempt honeybadger token to allow HB uptime checker in
     # https://docs.honeybadger.io/guides/security/
     (
@@ -193,6 +195,7 @@ class CatalogController < ApplicationController
   }
 
 end
+```
 
 ## Development and automated testing
 

data/app/controllers/concerns/bot_challenge_page/guard_action.rb

@@ -31,6 +31,16 @@ module BotChallengePage
           else
             # hacky way to get config to view template in an arbitrary controller, good enough for now
             controller.instance_variable_set("@bot_challenge_config", self.bot_challenge_config) unless controller.instance_variable_get("@bot_challenge_config")
+
+            # set preload HTTP header with turnstile url for better page speed
+            # May or may not be one there already, we can always add on
+            preload_link_value = %Q{<#{self.bot_challenge_config.cf_turnstile_js_url}>; rel=preload; as=script}
+            if controller.headers["link"].present?
+              controller.headers["link"] += ",#{preload_link_value}"
+            else
+              controller.headers["link"] = "#{preload_link_value}"
+            end
+
             controller.instance_exec &self.bot_challenge_config.challenge_renderer
           end
 

data/lib/bot_challenge_page/version.rb

@@ -1,3 +1,3 @@
 module BotChallengePage
-  VERSION = "0.10.0"
+  VERSION = "0.11.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bot_challenge_page
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.11.0
 platform: ruby
 authors:
 - Jonathan Rochkind
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-08-04 00:00:00.000000000 Z
+date: 2025-08-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: appraisal