cloudflare-turnstile-rails 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7a94bbf6a29069c0d4f5f291ca3e80d368942aad2e03f20ae7b64091f9d900e
-  data.tar.gz: 3156465de7ffac378b48b61250377536272acd9bd15998d61be263701fe92657
+  metadata.gz: 7a86ed02899dc2410a686143de9c188b3d15cfef8e4928bc87cc00bd1741fb58
+  data.tar.gz: 566026c1569d205f3a91beec381ec29729e6afe78084b9a6fb60ef4ceb0b3fad
 SHA512:
-  metadata.gz: e7304843b0657e901e07f3264e6ab6676914af2b9d6a8f38a0778b53587cff1ba7454c71793fe45cac69bb7741e8264e3495337fb4544bd5f88551e569847a5d
-  data.tar.gz: 808592cee1ae30ea1a6c19a9887bfe62d33979b991810bb078bec618a0e2e37ec4a93152d7f5552c4786245a25f4497e2ab7f0cdf925c387f0e5588468cb4a52
+  metadata.gz: 5a5a699a90fcb1a704de8a46ec57571c5219794d853d94a0d7bbac05e3e91dfa7ee20ddefaa1245d246a8b64bba082f58800821db4e2d4accc3ac16252eca204
+  data.tar.gz: e3655f9b725839b328f3699fd7dfb8def8f91d8011bd10dd4c8e4904cc6a12c61453a85bde4c666cd8d26185cb623da406ec634828785ff27d5833b6e5854594

data/README.md

@@ -5,7 +5,7 @@
 [![Rails](https://img.shields.io/badge/Rails-5.0%20to%208.1-D30001?logo=rubyonrails&logoColor=white)](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/Appraisals)
 [![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/cloudflare-turnstile-rails/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/test.yml)
 [![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/cloudflare-turnstile-rails/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/cloudflare-turnstile-rails/actions/workflows/lint.yml)
-[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/license/MIT)
 
 Cloudflare Turnstile gem for Ruby on Rails with built-in Turbo and Turbolinks support and CSP compliance.
 
@@ -16,7 +16,7 @@ Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rai
 ## Features
 
 * **One‑line integration**: `<%= cloudflare_turnstile_tag %>` in views, `valid_turnstile?(model:)` in controllers — no extra wiring.
-* **Turbo & Turbo Streams aware**: Automatically re‑initializes widgets on `turbo:load`, `turbo:before-stream-render`, and DOM mutations.
+* **Turbo & Turbo Streams aware**: Automatically re‑initializes widgets on `turbo:render` and `turbo:before-stream-render`.
 * **Legacy Turbolinks support**: Includes a helper for Turbolinks to handle remote form submissions with validation errors.
 * **CSP nonce support**: Honours Rails' `content_security_policy_nonce` for secure inline scripts.
 * **Rails Engine & Asset pipeline**: Ships a precompiled JS helper via Railtie — no manual asset setup.
@@ -154,6 +154,22 @@ Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rai
   end
   ```
 
+  The automatic message is a regular flash, so it survives exactly one redirect. If you **re-render the form** instead of redirecting, pass `flash: :now` to scope the message to that render, so it doesn't also appear on the next page the visitor opens:
+
+  ```ruby
+  def create
+    if valid_turnstile?(flash: :now)
+      # Passed: no message is set either way
+      redirect_to dashboard_path, notice: 'Success!'
+    else
+      # Failed: flash.now[:alert] is automatically set
+      render :new, status: :unprocessable_entity
+    end
+  end
+  ```
+
+  Passing a `model` is the other option for a re-rendered form: the failure goes to `model.errors` and no flash is set at all.
+
 * You may also pass additional **siteverify** parameters (e.g., `secret`, `response`, `remoteip`, `idempotency_key`) supported by Cloudflare's API:
   [Cloudflare Server-Side Validation Parameters](https://developers.cloudflare.com/turnstile/get-started/server-side-validation/#required-parameters)
 
@@ -302,9 +318,9 @@ Cloudflare provides dummy sitekeys and secret keys for development and testing.
 | Sitekey                    | Description                     | Visibility |
 |----------------------------|---------------------------------|------------|
 | `1x00000000000000000000AA` | Always passes                   | visible    |
-| `2x00000000000000000000AB` | Always blocks                   | visible    |
+| `2x00000000000000000000AB` | Always fails                    | visible    |
 | `1x00000000000000000000BB` | Always passes                   | invisible  |
-| `2x00000000000000000000BB` | Always blocks                   | invisible  |
+| `2x00000000000000000000BB` | Always fails                    | invisible  |
 | `3x00000000000000000000FF` | Forces an interactive challenge | visible    |
 
 ### Dummy Secret Keys
@@ -393,10 +409,11 @@ If you run into any issues after upgrading Rails, please [open an issue](https:/
 
 ### Setup
 
-Install dependencies, linters, and prepare everything in one step:
+Install the Ruby dependencies, then the JavaScript dependencies used by the ESLint step:
 
 ```bash
 bin/setup
+npm install
 ```
 
 ### Running the Test Suite
@@ -414,13 +431,13 @@ bundle exec appraisal rake test
 
 ### Code Linting
 
-Enforce code style with RuboCop (latest Ruby only):
+Run RuboCop and ESLint together (autocorrecting by default, or pass `--no-fix` to only report):
 
 ```bash
-bundle exec rubocop
+bin/lint
 ```
 
-> **CI Note:** We run this via [.github/workflows/lint.yml](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/.github/workflows/lint.yml) on the latest Ruby only.
+> **CI Note:** We run `bin/lint --no-fix` via [.github/workflows/lint.yml](https://github.com/vkononov/cloudflare-turnstile-rails/blob/main/.github/workflows/lint.yml) on the latest Ruby only.
 
 ### Generating Rails Apps Locally
 
@@ -461,4 +478,4 @@ Bug reports and pull requests are welcome on GitHub at https://github.com/vkonon
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/license/MIT).

data/lib/cloudflare/turnstile/rails/controller_methods.rb

@@ -17,10 +17,18 @@ module Cloudflare
           result
         end
 
-        def valid_turnstile?(model: nil, **opts)
+        # flash: :keep carries the automatic failure message into the next request,
+        # for a redirect. flash: :now scopes it to the response being rendered. The
+        # keyword shadows the controller's own flash method, hence request.flash.
+        def valid_turnstile?(model: nil, flash: :keep, **opts)
           response = verify_turnstile(model: model, **opts)
           success = response.is_a?(VerificationResponse) && response.success?
-          flash[:alert] = ErrorMessage.default if !success && model.nil?
+
+          if !success && model.nil?
+            store = flash == :now ? request.flash.now : request.flash
+            store[:alert] = ErrorMessage.default
+          end
+
           success
         end
 

data/lib/cloudflare/turnstile/rails/verification.rb

@@ -48,9 +48,7 @@ module Cloudflare
 
       module Verification
         def self.verify(response: nil, secret: nil, remoteip: nil, idempotency_key: nil) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
-          if (response.nil? || response.strip.empty?) && ::Rails.env.test? && Rails.configuration.auto_populate_response_in_test_env # rubocop:disable Layout/LineLength
-            response = 'dummy-response'
-          end
+          response = 'dummy-response' if auto_populate_test_response?(response)
 
           secret ||= Rails.configuration.secret_key
           if secret.nil? || secret.strip.empty?
@@ -89,6 +87,13 @@ module Cloudflare
 
           VerificationResponse.new(json)
         end
+
+        def self.auto_populate_test_response?(response)
+          (response.nil? || response.strip.empty?) &&
+            ::Rails.env.test? &&
+            Rails.configuration.auto_populate_response_in_test_env
+        end
+        private_class_method :auto_populate_test_response?
       end
     end
   end

data/lib/cloudflare/turnstile/rails/version.rb

@@ -1,7 +1,7 @@
 module Cloudflare
   module Turnstile
     module Rails
-      VERSION = '1.1.0'.freeze
+      VERSION = '1.2.0'.freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-turnstile-rails
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Vadim Kononov
@@ -83,7 +83,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Cloudflare Turnstile gem for Rails with built-in Turbo and Turbolinks support
   and CSP compliance