cloudflare-turnstile-rails 1.0.2 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 196412eb6b781fae101b937a9f76b0aa5eaebf94be239466cf3a9edc3175356b
-  data.tar.gz: 4077e06435e1c39254bd4b74aee2eaa7cb219cea37d8cbef8c37998e50f0075a
+  metadata.gz: 7a86ed02899dc2410a686143de9c188b3d15cfef8e4928bc87cc00bd1741fb58
+  data.tar.gz: 566026c1569d205f3a91beec381ec29729e6afe78084b9a6fb60ef4ceb0b3fad
 SHA512:
-  metadata.gz: 3e28b314dc36c83eaf191ecbe6a47e2477a7c80a54e7d791b5a3ee0d07c6f6617fbd3f06bb822c15cba75e3637b963c6524b40473eaa399932543f649abb85f1
-  data.tar.gz: d28f2f512b7efc7bd387e410e6829053c6a7019d730b3fb7dfa5bd69d87c59dab7dd0816187a621d7c80533c67931ce3511bca42266804f39e15f4ad77368e7d
+  metadata.gz: 5a5a699a90fcb1a704de8a46ec57571c5219794d853d94a0d7bbac05e3e91dfa7ee20ddefaa1245d246a8b64bba082f58800821db4e2d4accc3ac16252eca204
+  data.tar.gz: e3655f9b725839b328f3699fd7dfb8def8f91d8011bd10dd4c8e4904cc6a12c61453a85bde4c666cd8d26185cb623da406ec634828785ff27d5833b6e5854594

data/README.md

@@ -1,20 +1,22 @@
 # Cloudflare Turnstile Rails
 
-[![Gem Version](https://img.shields.io/gem/v/cloudflare-turnstile-rails.svg)](https://rubygems.org/gems/cloudflare-turnstile-rails)
-[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-[![Lint Status](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/lint.yml/badge.svg)](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/lint.yml)
-[![Test Status](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/test.yml/badge.svg)](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/test.yml)
+[![Gem Version](https://img.shields.io/gem/v/cloudflare-turnstile-rails.svg?label=Gem&logo=rubygems&logoColor=white)](https://rubygems.org/gems/cloudflare-turnstile-rails)
+[![Ruby](https://img.shields.io/badge/Ruby-2.6%20to%204.0-CC342D?logo=ruby&logoColor=white)](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/.github/workflows/test.yml)
+[![Rails](https://img.shields.io/badge/Rails-5.0%20to%208.1-D30001?logo=rubyonrails&logoColor=white)](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/Appraisals)
+[![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/cloudflare-turnstile-rails/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/test.yml)
+[![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/cloudflare-turnstile-rails/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/lint.yml)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/license/MIT)
 
 Cloudflare Turnstile gem for Ruby on Rails with built-in Turbo and Turbolinks support and CSP compliance.
 
-Supports `Rails >= 5.0` with `Ruby >= 2.6.0`.
+Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rails/Ruby matrix tested daily in CI.
 
 [!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
 
 ## Features
 
 * **One‑line integration**: `<%= cloudflare_turnstile_tag %>` in views, `valid_turnstile?(model:)` in controllers — no extra wiring.
-* **Turbo & Turbo Streams aware**: Automatically re‑initializes widgets on `turbo:load`, `turbo:before-stream-render`, and DOM mutations.
+* **Turbo & Turbo Streams aware**: Automatically re‑initializes widgets on `turbo:render` and `turbo:before-stream-render`.
 * **Legacy Turbolinks support**: Includes a helper for Turbolinks to handle remote form submissions with validation errors.
 * **CSP nonce support**: Honours Rails' `content_security_policy_nonce` for secure inline scripts.
 * **Rails Engine & Asset pipeline**: Ships a precompiled JS helper via Railtie — no manual asset setup.
@@ -87,10 +89,35 @@ Supports `Rails >= 5.0` with `Ruby >= 2.6.0`.
    <%= cloudflare_turnstile_tag %>
    ```
 
-  That's it! Though it is recommended to match your `theme` and `language` to your app's design and locale:
+  That's it! By default the widget auto-detects the visitor's `theme` and `language`.
+
+* To match your app's design and locale, set defaults once in the initializer and they'll apply to every `cloudflare_turnstile_tag` automatically:
+
+  ```ruby
+  Cloudflare::Turnstile::Rails.configure do |config|
+    config.default_data = {
+      theme: 'light',
+      language: 'en'
+    }
+  end
+  ```
+
+  Values may also be a proc, evaluated at render time — useful for following the current locale:
+
+  ```ruby
+  config.default_data = { language: -> { I18n.locale } }
+  ```
+
+* You can still override any default (or add extra options) on an individual tag via the `data:` option. Per-tag values take precedence over the configured defaults:
 
    ```erb
-   <%= cloudflare_turnstile_tag data: { theme: 'light', language: 'en' } %>
+   <%= cloudflare_turnstile_tag data: { theme: 'dark' } %>
+   ```
+
+* To drop a configured default on a single tag (so its attribute isn't rendered at all), pass `nil` for that key:
+
+   ```erb
+   <%= cloudflare_turnstile_tag data: { theme: nil } %>
    ```
 
 * For all available **data-**\* options (e.g., `action`, `cdata`, `theme`, etc.), refer to the official Cloudflare client-side rendering docs:
@@ -127,6 +154,22 @@ Supports `Rails >= 5.0` with `Ruby >= 2.6.0`.
   end
   ```
 
+  The automatic message is a regular flash, so it survives exactly one redirect. If you **re-render the form** instead of redirecting, pass `flash: :now` to scope the message to that render, so it doesn't also appear on the next page the visitor opens:
+
+  ```ruby
+  def create
+    if valid_turnstile?(flash: :now)
+      # Passed: no message is set either way
+      redirect_to dashboard_path, notice: 'Success!'
+    else
+      # Failed: flash.now[:alert] is automatically set
+      render :new, status: :unprocessable_entity
+    end
+  end
+  ```
+
+  Passing a `model` is the other option for a re-rendered form: the failure goes to `model.errors` and no flash is set at all.
+
 * You may also pass additional **siteverify** parameters (e.g., `secret`, `response`, `remoteip`, `idempotency_key`) supported by Cloudflare's API:
   [Cloudflare Server-Side Validation Parameters](https://developers.cloudflare.com/turnstile/get-started/server-side-validation/#required-parameters)
 
@@ -275,9 +318,9 @@ Cloudflare provides dummy sitekeys and secret keys for development and testing.
 | Sitekey                    | Description                     | Visibility |
 |----------------------------|---------------------------------|------------|
 | `1x00000000000000000000AA` | Always passes                   | visible    |
-| `2x00000000000000000000AB` | Always blocks                   | visible    |
+| `2x00000000000000000000AB` | Always fails                    | visible    |
 | `1x00000000000000000000BB` | Always passes                   | invisible  |
-| `2x00000000000000000000BB` | Always blocks                   | invisible  |
+| `2x00000000000000000000BB` | Always fails                    | invisible  |
 | `3x00000000000000000000FF` | Forces an interactive challenge | visible    |
 
 ### Dummy Secret Keys
@@ -366,10 +409,11 @@ If you run into any issues after upgrading Rails, please [open an issue](https:/
 
 ### Setup
 
-Install dependencies, linters, and prepare everything in one step:
+Install the Ruby dependencies, then the JavaScript dependencies used by the ESLint step:
 
 ```bash
 bin/setup
+npm install
 ```
 
 ### Running the Test Suite
@@ -387,13 +431,13 @@ bundle exec appraisal rake test
 
 ### Code Linting
 
-Enforce code style with RuboCop (latest Ruby only):
+Run RuboCop and ESLint together (autocorrecting by default, or pass `--no-fix` to only report):
 
 ```bash
-bundle exec rubocop
+bin/lint
 ```
 
-> **CI Note:** We run this via [.github/workflows/lint.yml](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/.github/workflows/lint.yml) on the latest Ruby only.
+> **CI Note:** We run `bin/lint --no-fix` via [.github/workflows/lint.yml](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/.github/workflows/lint.yml) on the latest Ruby only.
 
 ### Generating Rails Apps Locally
 
@@ -434,4 +478,4 @@ Bug reports and pull requests are welcome on GitHub at https://github.com/vkonon
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/license/MIT).

data/lib/cloudflare/turnstile/rails/configuration.rb

@@ -3,7 +3,7 @@ module Cloudflare
     module Rails
       class Configuration
         attr_writer :script_url
-        attr_accessor :site_key, :secret_key, :render, :onload, :auto_populate_response_in_test_env
+        attr_accessor :site_key, :secret_key, :render, :onload, :default_data, :auto_populate_response_in_test_env
 
         def initialize
           @script_url = Cloudflare::SCRIPT_URL
@@ -11,6 +11,7 @@ module Cloudflare
           @secret_key = nil
           @render = nil
           @onload = nil
+          @default_data = {}
           @auto_populate_response_in_test_env = true
         end
 

data/lib/cloudflare/turnstile/rails/controller_methods.rb

@@ -17,10 +17,18 @@ module Cloudflare
           result
         end
 
-        def valid_turnstile?(model: nil, **opts)
+        # flash: :keep carries the automatic failure message into the next request,
+        # for a redirect. flash: :now scopes it to the response being rendered. The
+        # keyword shadows the controller's own flash method, hence request.flash.
+        def valid_turnstile?(model: nil, flash: :keep, **opts)
           response = verify_turnstile(model: model, **opts)
           success = response.is_a?(VerificationResponse) && response.success?
-          flash[:alert] = ErrorMessage.default if !success && model.nil?
+
+          if !success && model.nil?
+            store = flash == :now ? request.flash.now : request.flash
+            store[:alert] = ErrorMessage.default
+          end
+
           success
         end
 

data/lib/cloudflare/turnstile/rails/helpers.rb

@@ -7,7 +7,7 @@ module Cloudflare
         def cloudflare_turnstile_tag(site_key: nil, include_script: true, **html_options) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength
           site_key ||= Rails.configuration.site_key
           html_options[:class] = Cloudflare::WIDGET_CLASS unless html_options.key?(:class)
-          html_options[:data] ||= {}
+          html_options[:data] = cloudflare_turnstile_default_data.merge(html_options[:data] || {})
           html_options[:data][:sitekey] ||= site_key
 
           script_tag = nil
@@ -27,6 +27,16 @@ module Cloudflare
           widget = content_tag(:div, '', html_options)
           safe_join([script_tag, widget].compact, "\n")
         end
+
+        private
+
+        # Resolves the configured default data attributes, evaluating any
+        # callable values (e.g. a proc bound to I18n.locale) at render time.
+        def cloudflare_turnstile_default_data
+          (Rails.configuration.default_data || {}).transform_values do |value|
+            value.respond_to?(:call) ? value.call : value
+          end
+        end
       end
     end
   end

data/lib/cloudflare/turnstile/rails/verification.rb

@@ -48,9 +48,7 @@ module Cloudflare
 
       module Verification
         def self.verify(response: nil, secret: nil, remoteip: nil, idempotency_key: nil) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
-          if (response.nil? || response.strip.empty?) && ::Rails.env.test? && Rails.configuration.auto_populate_response_in_test_env # rubocop:disable Layout/LineLength
-            response = 'dummy-response'
-          end
+          response = 'dummy-response' if auto_populate_test_response?(response)
 
           secret ||= Rails.configuration.secret_key
           if secret.nil? || secret.strip.empty?
@@ -89,6 +87,13 @@ module Cloudflare
 
           VerificationResponse.new(json)
         end
+
+        def self.auto_populate_test_response?(response)
+          (response.nil? || response.strip.empty?) &&
+            ::Rails.env.test? &&
+            Rails.configuration.auto_populate_response_in_test_env
+        end
+        private_class_method :auto_populate_test_response?
       end
     end
   end

data/lib/cloudflare/turnstile/rails/version.rb

@@ -1,7 +1,7 @@
 module Cloudflare
   module Turnstile
     module Rails
-      VERSION = '1.0.2'.freeze
+      VERSION = '1.2.0'.freeze
     end
   end
 end

data/lib/generators/cloudflare_turnstile/templates/cloudflare_turnstile.rb

@@ -16,6 +16,15 @@ Cloudflare::Turnstile::Rails.configure do |config|
   # config.render = 'explicit'
   # config.onload = 'onloadTurnstileCallback'
 
+  # Optional: Default data-* attributes applied to every `cloudflare_turnstile_tag`.
+  # These are merged into each widget and can be overridden per tag via the `data:` option.
+  # See https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/#configuration-options
+  # Values may be a proc, evaluated at render time (e.g. to follow the current locale).
+  # config.default_data = {
+  #   theme: 'auto',
+  #   language: -> { I18n.locale }
+  # }
+
   # In the Rails Test environment, automatically fill in a dummy response if none was provided.
   # This lets you keep existing controller tests without having to add
   # params["cf-turnstile-response"] manually in every test.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-turnstile-rails
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.2.0
 platform: ruby
 authors:
 - Vadim Kononov
@@ -83,7 +83,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Cloudflare Turnstile gem for Rails with built-in Turbo and Turbolinks support
   and CSP compliance