cloudflare-turnstile-rails 1.1.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7a94bbf6a29069c0d4f5f291ca3e80d368942aad2e03f20ae7b64091f9d900e
-  data.tar.gz: 3156465de7ffac378b48b61250377536272acd9bd15998d61be263701fe92657
+  metadata.gz: 7bdf250ea2814264e89921898dcc1c38b968596fe59e9423914b2d245ee8607c
+  data.tar.gz: e72026fff680a00cccfdb6134fbe9dafe0658abc8c135b0c5a4bc73404a1a104
 SHA512:
-  metadata.gz: e7304843b0657e901e07f3264e6ab6676914af2b9d6a8f38a0778b53587cff1ba7454c71793fe45cac69bb7741e8264e3495337fb4544bd5f88551e569847a5d
-  data.tar.gz: 808592cee1ae30ea1a6c19a9887bfe62d33979b991810bb078bec618a0e2e37ec4a93152d7f5552c4786245a25f4497e2ab7f0cdf925c387f0e5588468cb4a52
+  metadata.gz: dfe05337cc155cd855b9297c8512d1c173069862a33f3061b685e41db3ec4ac7c20e86466d2c90d82d10795ccb0560b64177a344a5098885506efc53f614872d
+  data.tar.gz: aa3d5dacc7e140dedf475881f61522480b30c87e39bf1b228999ed5244fbe33cf1f02af3ffa6575bc2e0a09acb78221375b2fe82863dfcf13274398bac631d3d

data/README.md

@@ -5,18 +5,21 @@
 [![Rails](https://img.shields.io/badge/Rails-5.0%20to%208.1-D30001?logo=rubyonrails&logoColor=white)](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/Appraisals)
 [![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/cloudflare-turnstile-rails/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/test.yml)
 [![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/cloudflare-turnstile-rails/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/lint.yml)
-[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/license/MIT)
 
 Cloudflare Turnstile gem for Ruby on Rails with built-in Turbo and Turbolinks support and CSP compliance.
 
 Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rails/Ruby matrix tested daily in CI.
 
+> [!TIP]
+> **Using Devise?** [devise-cloudflare-turnstile](https://github.com/vkononov/devise-cloudflare-turnstile) protects every Devise form (sign in, sign up, password reset, and more) with no changes to your Devise views or controllers. It is built on this gem and shares its configuration, so you can use both to protect Devise and non-Devise forms in the same app.
+
 [!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
 
 ## Features
 
 * **One‑line integration**: `<%= cloudflare_turnstile_tag %>` in views, `valid_turnstile?(model:)` in controllers — no extra wiring.
-* **Turbo & Turbo Streams aware**: Automatically re‑initializes widgets on `turbo:load`, `turbo:before-stream-render`, and DOM mutations.
+* **Turbo & Turbo Streams aware**: Automatically re‑initializes widgets on `turbo:render` and `turbo:before-stream-render`.
 * **Legacy Turbolinks support**: Includes a helper for Turbolinks to handle remote form submissions with validation errors.
 * **CSP nonce support**: Honours Rails' `content_security_policy_nonce` for secure inline scripts.
 * **Rails Engine & Asset pipeline**: Ships a precompiled JS helper via Railtie — no manual asset setup.
@@ -154,6 +157,22 @@ Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rai
   end
   ```
 
+  The automatic message is a regular flash, so it survives exactly one redirect. If you **re-render the form** instead of redirecting, pass `flash: :now` to scope the message to that render, so it doesn't also appear on the next page the visitor opens:
+
+  ```ruby
+  def create
+    if valid_turnstile?(flash: :now)
+      # Passed: no message is set either way
+      redirect_to dashboard_path, notice: 'Success!'
+    else
+      # Failed: flash.now[:alert] is automatically set
+      render :new, status: :unprocessable_entity
+    end
+  end
+  ```
+
+  Passing a `model` is the other option for a re-rendered form: the failure goes to `model.errors` and no flash is set at all.
+
 * You may also pass additional **siteverify** parameters (e.g., `secret`, `response`, `remoteip`, `idempotency_key`) supported by Cloudflare's API:
   [Cloudflare Server-Side Validation Parameters](https://developers.cloudflare.com/turnstile/get-started/server-side-validation/#required-parameters)
 
@@ -168,6 +187,16 @@ Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rai
   end
   ```
 
+* Requests to Cloudflare time out after 5 seconds to connect, read, or write, so a slow Cloudflare can't tie up your app's request threads for long. A timeout raises `Cloudflare::Turnstile::Rails::ConfigurationError`. To change the limits:
+
+  ```ruby
+  Cloudflare::Turnstile::Rails.configure do |config|
+    config.open_timeout = 5  # connecting to siteverify
+    config.read_timeout = 5  # reading the response
+    config.write_timeout = 5 # sending the verification POST
+  end
+  ```
+
 #### Advanced Validation
 
 * To inspect the entire verification payload, use `verify_turnstile`. It returns a `VerificationResponse` object with detailed information:
@@ -187,6 +216,8 @@ Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rai
   end
   ```
 
+* A missing, malformed, or oversized token fails immediately with `missing-input-response` or `invalid-input-response`, without a request to Cloudflare. The `VerificationResponse` for these failures only has `success` and `error-codes`; it doesn't carry `hostname`, `challenge_ts`, or the other fields a real siteverify call returns.
+
 * The `VerificationResponse` object contains the raw response from Cloudflare:
 
   ```ruby
@@ -302,9 +333,9 @@ Cloudflare provides dummy sitekeys and secret keys for development and testing.
 | Sitekey                    | Description                     | Visibility |
 |----------------------------|---------------------------------|------------|
 | `1x00000000000000000000AA` | Always passes                   | visible    |
-| `2x00000000000000000000AB` | Always blocks                   | visible    |
+| `2x00000000000000000000AB` | Always fails                    | visible    |
 | `1x00000000000000000000BB` | Always passes                   | invisible  |
-| `2x00000000000000000000BB` | Always blocks                   | invisible  |
+| `2x00000000000000000000BB` | Always fails                    | invisible  |
 | `3x00000000000000000000FF` | Forces an interactive challenge | visible    |
 
 ### Dummy Secret Keys
@@ -393,10 +424,11 @@ If you run into any issues after upgrading Rails, please [open an issue](https:/
 
 ### Setup
 
-Install dependencies, linters, and prepare everything in one step:
+Install the Ruby dependencies, then the JavaScript dependencies used by the ESLint step:
 
 ```bash
 bin/setup
+npm install
 ```
 
 ### Running the Test Suite
@@ -414,13 +446,13 @@ bundle exec appraisal rake test
 
 ### Code Linting
 
-Enforce code style with RuboCop (latest Ruby only):
+Run RuboCop and ESLint together (autocorrecting by default, or pass `--no-fix` to only report):
 
 ```bash
-bundle exec rubocop
+bin/lint
 ```
 
-> **CI Note:** We run this via [.github/workflows/lint.yml](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/.github/workflows/lint.yml) on the latest Ruby only.
+> **CI Note:** We run `bin/lint --no-fix` via [.github/workflows/lint.yml](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/.github/workflows/lint.yml) on the latest Ruby only.
 
 ### Generating Rails Apps Locally
 
@@ -461,4 +493,4 @@ Bug reports and pull requests are welcome on GitHub at https://github.com/vkonon
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/license/MIT).

data/lib/cloudflare/turnstile/rails/configuration.rb

@@ -3,7 +3,8 @@ module Cloudflare
     module Rails
       class Configuration
         attr_writer :script_url
-        attr_accessor :site_key, :secret_key, :render, :onload, :default_data, :auto_populate_response_in_test_env
+        attr_accessor :site_key, :secret_key, :render, :onload, :default_data, :auto_populate_response_in_test_env,
+                      :open_timeout, :read_timeout, :write_timeout
 
         def initialize
           @script_url = Cloudflare::SCRIPT_URL
@@ -13,6 +14,9 @@ module Cloudflare
           @onload = nil
           @default_data = {}
           @auto_populate_response_in_test_env = true
+          @open_timeout = 5
+          @read_timeout = 5
+          @write_timeout = 5
         end
 
         # Dynamically build the URL every time, so that

data/lib/cloudflare/turnstile/rails/constants/cloudflare.rb

@@ -11,6 +11,9 @@ module Cloudflare
         # Default hidden input field name for Turnstile token submission
         RESPONSE_FIELD_NAME = 'cf-turnstile-response'.freeze
 
+        # Longest token siteverify accepts; anything longer is rejected without a request
+        MAX_RESPONSE_LENGTH = 2048
+
         # Default CSS class applied to Turnstile widget containers
         WIDGET_CLASS = 'cf-turnstile'.freeze
       end

data/lib/cloudflare/turnstile/rails/controller_methods.rb

@@ -17,10 +17,18 @@ module Cloudflare
           result
         end
 
-        def valid_turnstile?(model: nil, **opts)
+        # flash: :keep carries the automatic failure message into the next request,
+        # for a redirect. flash: :now scopes it to the response being rendered. The
+        # keyword shadows the controller's own flash method, hence request.flash.
+        def valid_turnstile?(model: nil, flash: :keep, **opts)
           response = verify_turnstile(model: model, **opts)
           success = response.is_a?(VerificationResponse) && response.success?
-          flash[:alert] = ErrorMessage.default if !success && model.nil?
+
+          if !success && model.nil?
+            store = flash == :now ? request.flash.now : request.flash
+            store[:alert] = ErrorMessage.default
+          end
+
           success
         end
 

data/lib/cloudflare/turnstile/rails/verification.rb

@@ -2,6 +2,7 @@ require 'net/http'
 require 'openssl'
 
 require_relative 'constants/cloudflare'
+require_relative 'constants/error_code'
 
 module Cloudflare
   module Turnstile
@@ -48,15 +49,25 @@ module Cloudflare
 
       module Verification
         def self.verify(response: nil, secret: nil, remoteip: nil, idempotency_key: nil) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
-          if (response.nil? || response.strip.empty?) && ::Rails.env.test? && Rails.configuration.auto_populate_response_in_test_env # rubocop:disable Layout/LineLength
-            response = 'dummy-response'
+          if response.is_a?(String) && !response.valid_encoding?
+            return VerificationResponse.new('success' => false, 'error-codes' => [ErrorCode::INVALID_INPUT_RESPONSE])
           end
 
+          response = 'dummy-response' if auto_populate_test_response?(response)
+
           secret ||= Rails.configuration.secret_key
           if secret.nil? || secret.strip.empty?
             raise ConfigurationError, ErrorMessage.for(ErrorCode::MISSING_INPUT_SECRET)
           end
 
+          local_error = if missing_response?(response)
+                          ErrorCode::MISSING_INPUT_RESPONSE
+                        elsif invalid_response?(response)
+                          ErrorCode::INVALID_INPUT_RESPONSE
+                        end
+
+          return VerificationResponse.new('success' => false, 'error-codes' => [local_error]) if local_error
+
           body = { 'secret' => secret, 'response' => response }
           body['remoteip'] = remoteip if remoteip
           body['idempotency_key'] = idempotency_key if idempotency_key
@@ -67,17 +78,20 @@ module Cloudflare
 
           http = Net::HTTP.new(uri.host, uri.port)
           http.use_ssl = true
+          http.open_timeout = Rails.configuration.open_timeout
+          http.read_timeout = Rails.configuration.read_timeout
+          http.write_timeout = Rails.configuration.write_timeout
           http.verify_mode = OpenSSL::SSL::VERIFY_PEER
           http.cert_store = OpenSSL::X509::Store.new
           http.cert_store.set_default_paths
 
           begin
             res = http.request(request)
-          rescue Net::OpenTimeout, Net::ReadTimeout => e
+          rescue Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout, Errno::ETIMEDOUT => e
             raise ConfigurationError, "Turnstile verification timed out: #{e.message}"
           rescue OpenSSL::SSL::SSLError => e
             raise ConfigurationError, "SSL verification failed: #{e.message}"
-          rescue SocketError, Errno::ECONNREFUSED => e
+          rescue SocketError, EOFError, Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EHOSTUNREACH => e
             raise ConfigurationError, "Network error during Turnstile verification: #{e.message}"
           end
 
@@ -89,6 +103,23 @@ module Cloudflare
 
           VerificationResponse.new(json)
         end
+
+        def self.auto_populate_test_response?(response)
+          (response.nil? || (response.is_a?(String) && response.strip.empty?)) &&
+            ::Rails.env.test? &&
+            Rails.configuration.auto_populate_response_in_test_env
+        end
+        private_class_method :auto_populate_test_response?
+
+        def self.missing_response?(response)
+          response.nil? || response == ''
+        end
+        private_class_method :missing_response?
+
+        def self.invalid_response?(response)
+          !response.is_a?(String) || response.strip.empty? || response.length > Cloudflare::MAX_RESPONSE_LENGTH
+        end
+        private_class_method :invalid_response?
       end
     end
   end

data/lib/cloudflare/turnstile/rails/version.rb

@@ -1,7 +1,7 @@
 module Cloudflare
   module Turnstile
     module Rails
-      VERSION = '1.1.0'.freeze
+      VERSION = '1.3.0'.freeze
     end
   end
 end

data/lib/generators/cloudflare_turnstile/templates/cloudflare_turnstile.rb

@@ -25,6 +25,12 @@ Cloudflare::Turnstile::Rails.configure do |config|
   #   language: -> { I18n.locale }
   # }
 
+  # Optional: Seconds to wait when connecting to, and reading from, Cloudflare's siteverify endpoint.
+  # Keep these short so a slow Cloudflare can't hold your app's request threads for long.
+  # config.open_timeout = 5  # connecting to siteverify
+  # config.read_timeout = 5  # reading the response
+  # config.write_timeout = 5 # sending the verification POST
+
   # In the Rails Test environment, automatically fill in a dummy response if none was provided.
   # This lets you keep existing controller tests without having to add
   # params["cf-turnstile-response"] manually in every test.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-turnstile-rails
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Vadim Kononov
@@ -23,8 +23,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
-description: Integrates Cloudflare Turnstile into Ruby on Rails applications, transparently
-  reloads on Turbo and Turbolinks events, and embeds CSP-nonce-compliant scripts.
+description: Cloudflare Turnstile CAPTCHA, a reCAPTCHA alternative, for Ruby on Rails.
+  View and controller helpers with Turbo, Turbo Streams, Turbolinks, CSP nonce and
+  i18n support.
 email:
 - vadim@konoson.com
 executables: []
@@ -83,8 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
-summary: Cloudflare Turnstile gem for Rails with built-in Turbo and Turbolinks support
-  and CSP compliance
+summary: Cloudflare Turnstile CAPTCHA for Rails with Turbo, Turbolinks and CSP support
 test_files: []