devise-cloudflare-turnstile 0.10.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b29bbe949d442bee08751e705b15350414748639b11d73296b84647a3492325e
-  data.tar.gz: 11159165db1ab0a0b9d1f3d09367c2ece59eff3d2fb875b1f84bd465be37c43e
+  metadata.gz: 11f41c4964063781c8e59be1c7030ce996230ece6674388be3a12cb0ebfbc1f8
+  data.tar.gz: 8da777725211daaf3d95c5ef642f52ce1dfa6cbcc09890d344614fa3e7b441de
 SHA512:
-  metadata.gz: 9323f0c853e494ff79d6c1a7e02e0918e1931072a147c3fbeec1424bdc4966fdaeb34ae75fb333b605f28b22238416c728ba24638467b27380a17ac93ac70e82
-  data.tar.gz: ce5cf4f403126a3a8ac08fb8613ddeb300f21085aa0e47cf20a195cd78a3930fe0207ac12b530c4c0c53d936646247667a1cf5a9ccfaf70505824386fed4bc46
+  metadata.gz: e28097cca5cdfe4a358980ea4d443d4a6edd761cab258efc82b22188cf2d6a08233def94e755bc0b0470db189c3f6e5898dd687671935e19ab30f26542342d7e
+  data.tar.gz: 27ea16b46b2605f5fac172e583054677bb0b2ef791ba873a672a312cee371a25b47ccc498213af58066b68b71969a210e121c2724f83f8546e43d2cdf2a190ba

data/README.md

@@ -5,7 +5,7 @@
 [![Rails](https://img.shields.io/badge/Rails-5.0%20to%208.1-D30001?logo=rubyonrails&logoColor=white)](https://github.com/vkononov/devise-cloudflare-turnstile/blob/main/Appraisals)
 [![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/devise-cloudflare-turnstile/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/devise-cloudflare-turnstile/actions/workflows/test.yml)
 [![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/devise-cloudflare-turnstile/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/devise-cloudflare-turnstile/actions/workflows/lint.yml)
-[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/license/MIT)
 
 Automatically protect all Devise authentication forms with Cloudflare Turnstile. Add two helper tags to your layout, set your API keys, and every Devise form is protected — no changes to your Devise views or controllers.
 
@@ -84,8 +84,10 @@ That's it — all Devise forms are now protected.
 
 ### How It Works
 
-* **Controller** — a `before_action` on every Devise controller verifies the Turnstile response on `create` and re-renders the form with an error if it fails.
-* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button.
+* **Controller** — a `before_action` on every Devise controller verifies the Turnstile response on `create` and re-renders the form if it fails, reporting the failure as `flash.now[:alert]`. Your layout must render `alert` for the message to be seen.
+* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button. Only forms with a field a person fills in are considered, so action-only POST forms such as OAuth sign-in and log-out buttons are skipped.
+
+The widget appears only on the `create` forms (and their `new` pages) — sign in, sign up, password-reset request, and resend confirmation/unlock. Authenticated and edit pages such as account settings, password-reset completion, and accepting an invitation are left untouched.
 
 Widget rendering, script loading, CSP nonces, and Turbo/Turbolinks handling are delegated to [cloudflare-turnstile-rails](https://github.com/vkononov/cloudflare-turnstile-rails).
 
@@ -176,10 +178,12 @@ end
 
 | Situation | Behavior |
 |-----------|----------|
-| No custom controllers | All Devise controllers are protected automatically |
+| No custom controllers | All Devise controllers are protected automatically on their `create` actions |
+| Edit / authenticated pages (account settings, password-reset completion, accept invitation) | Not protected — the widget only appears on the `create` forms |
 | Custom controller with `skip_turnstile` (or config `skip`) | That controller/action opts out of both widget and verification |
 | No custom views | Devise's default views render; the widget still injects |
-| Custom view without a widget | The widget is still injected before the submit button |
+| Custom view without a widget | The widget is injected before the submit button if the form has a fillable field: a text, email, password, `textarea` or `select` field counts, a hidden input, checkbox, radio or file input does not |
+| Action-only POST form (OAuth sign-in, log out, delete) | No fillable field, so no widget |
 | Custom view with `cloudflare_turnstile_tag` | Your widget is used as-is; nothing is auto-injected |
 | Invisible vs visible widget | Determined by the site key's widget type in the Cloudflare dashboard |
 
@@ -191,7 +195,7 @@ Cloudflare provides dummy sitekeys and secret keys for development and testing.
 |----------|-------|----------|
 | Site Key | `1x00000000000000000000AA` | Always passes (visible) |
 | Secret Key | `1x0000000000000000000000000000000AA` | Always passes |
-| Site Key | `2x00000000000000000000AB` | Always blocks (visible) |
+| Site Key | `2x00000000000000000000AB` | Always fails (visible) |
 | Secret Key | `2x0000000000000000000000000000000AA` | Always fails |
 
 ## Development
@@ -224,7 +228,7 @@ Run RuboCop and ESLint together:
 bin/lint
 ```
 
-> **CI Note:** We run this via [.github/workflows/lint.yml](.github/workflows/lint.yml) on the latest Ruby only.
+> **CI Note:** We run `bin/lint --no-fix` via [.github/workflows/lint.yml](.github/workflows/lint.yml) on the latest Ruby only.
 
 ## Contributing
 

data/app/assets/javascripts/devise_cloudflare_turnstile.js

@@ -43,6 +43,15 @@
     }
   }
 
+  // Hidden inputs, checkboxes, radios and file inputs don't count as fillable.
+  function hasFillableField(form) {
+    var selector = 'input[type="text"], input[type="email"], input[type="password"], ' +
+      'input[type="search"], input[type="tel"], input[type="url"], ' +
+      'input[type="number"], input:not([type]), textarea, select';
+
+    return form.querySelector(selector) !== null;
+  }
+
   function renderWidget(widget) {
     if (widget.dataset.initialized || widget.childElementCount > 0) {
       return;
@@ -81,6 +90,10 @@
       widget = form.querySelector('.' + WIDGET_CLASS);
 
       if (!widget) {
+        if (!hasFillableField(form)) {
+          continue;
+        }
+
         submit = form.querySelector('input[type="submit"], button[type="submit"], button:not([type])');
 
         if (!submit) {

data/lib/devise/cloudflare/turnstile/controller_concern.rb

@@ -10,7 +10,7 @@ module Devise
           class_attribute :_turnstile_skip_rules, instance_accessor: false
           self._turnstile_skip_rules = []
 
-          before_action :verify_cloudflare_turnstile!, only: :create
+          before_action :verify_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :set_turnstile_page_marker, if: :turnstile_form_action?
         end
 
@@ -30,23 +30,30 @@ module Devise
 
         private
 
-        def verify_cloudflare_turnstile! # rubocop:disable Metrics/AbcSize
+        def verify_cloudflare_turnstile!
           return if turnstile_skipped?
 
           self.resource ||= resource_class.new
-          return if valid_turnstile?(model: resource, **turnstile_verify_options)
+          # No model is passed, so the failure stays out of resource.errors and is
+          # reported through the flash, scoped to the render below.
+          return if valid_turnstile?(flash: :now, **turnstile_verify_options)
 
+          revoke_params_authentication!
           restore_turnstile_submitted_values
-
-          # Sessions (and some other Devise views) do not render resource errors.
-          # Always surface the failure via flash so the user sees feedback.
-          flash.now[:alert] = ::Cloudflare::Turnstile::Rails::ErrorMessage.default
           clean_up_passwords(resource) if respond_to?(:clean_up_passwords, true)
           set_minimum_password_length if respond_to?(:set_minimum_password_length, true)
           set_turnstile_page_marker
           render turnstile_failure_action, status: :unprocessable_entity
         end
 
+        # Devise's sessions#create marks the request eligible for authentication
+        # straight from the posted credentials. That flag outlives our halt, so
+        # any current_user call during the failure render would sign the visitor
+        # in. Devise publishes no constant for the key.
+        def revoke_params_authentication!
+          request.env.delete('devise.allow_params_authentication')
+        end
+
         # Re-populate the resource with the values the user just submitted (minus
         # passwords) so the re-rendered form keeps their input. We fail in a
         # before_action, before Devise builds the resource from params, so
@@ -85,13 +92,21 @@ module Devise
           @_devise_turnstile_protected = true
         end
 
-        # Include create/update so failed submissions that re-render the form
-        # still emit the Turnstile meta tag and scripts. Without this, Turbo
-        # merges a head that omits them and the widget never comes back.
+        # Verify only on create. Kept as a predicate rather than `only: :create`
+        # so the callback is skipped cleanly on controllers without a create
+        # action instead of raising.
+        def turnstile_verify_action?
+          action_name == 'create'
+        end
+
+        # The widget shows on the create forms (`new`) and on `create` itself, so
+        # a failed submission that re-renders still emits the meta tag and scripts
+        # that Turbo needs. Edit/update pages are excluded because only `create`
+        # is verified.
         def turnstile_form_action?
           return false if turnstile_skipped?
 
-          action_name.in?(%w[new edit create update])
+          action_name.in?(%w[new create])
         end
 
         def turnstile_skipped?

data/lib/devise/cloudflare/turnstile/version.rb

@@ -1,7 +1,7 @@
 module Devise
   module Cloudflare
     module Turnstile
-      VERSION = '0.10.0'.freeze
+      VERSION = '0.12.0'.freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-cloudflare-turnstile
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.12.0
 platform: ruby
 authors:
 - Vadim Kononov
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '1.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -79,7 +79,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Cloudflare Turnstile integration for Devise
 test_files: []