devise-cloudflare-turnstile 0.11.0 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95edf74912abe68de902d9a5e3cf58c59f8f44d3a60f0b5cfb3ac6105e981ff6
-  data.tar.gz: b01582121ba114a8044e010fcd782e8baca8100a220150c4eb6dc2f85af9ac7d
+  metadata.gz: 471aea45843200703b848a8aacef060af2362f7103fae9f417df4f9e092bae12
+  data.tar.gz: a33a85702790274610f4580978a446037f5c468680a0128517105d14f58d9061
 SHA512:
-  metadata.gz: dc8dba667dcec474d7464faa259cccc99abaa45823fcedfe26520098ede8b9fd4c78a0849cf0c0e03b85550e0f7cd2527a55c7d60628ba0f243f17aa7074e0ee
-  data.tar.gz: 05ccb44987629b192af3087fcbe463989b30791f31526c3f8c134dc49e45cf5d6e79b7d44dba4de5d948b3ddc23ba55fa6da1ef18a56cfbfdcab9113691860cf
+  metadata.gz: b4ada2a98896212e2b0d0c60ac5f81cbf0c56cd204c026273617eefec30aece67b114f6809d2cf81261876c6ac77c4348972dbd0abd48f3e3c7d7794697bc9da
+  data.tar.gz: e57e4598eec7ea12bfbad15dfe25855322e0b9d48cef81114b49ef5b66115c6e063f8c7b9bc28a68a5e29390a4c54c58aaf3f7eabc5eeebc000170d059ee55a9

data/README.md

@@ -5,7 +5,7 @@
 [![Rails](https://img.shields.io/badge/Rails-5.0%20to%208.1-D30001?logo=rubyonrails&logoColor=white)](https://github.com/vkononov/devise-cloudflare-turnstile/blob/main/Appraisals)
 [![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/devise-cloudflare-turnstile/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/devise-cloudflare-turnstile/actions/workflows/test.yml)
 [![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/devise-cloudflare-turnstile/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/devise-cloudflare-turnstile/actions/workflows/lint.yml)
-[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/license/MIT)
 
 Automatically protect all Devise authentication forms with Cloudflare Turnstile. Add two helper tags to your layout, set your API keys, and every Devise form is protected — no changes to your Devise views or controllers.
 
@@ -84,8 +84,8 @@ That's it — all Devise forms are now protected.
 
 ### How It Works
 
-* **Controller** — a `before_action` on every Devise controller verifies the Turnstile response on `create` and re-renders the form with an error if it fails.
-* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button. Rails `button_to` action buttons (e.g. OAuth sign-in or log out) are skipped.
+* **Controller** — a `before_action` on every Devise controller verifies the Turnstile response on `create` and re-renders the form if it fails, reporting the failure as `flash.now[:alert]`. Your layout must render `alert` for the message to be seen.
+* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button. Only forms with a field a person fills in are considered, so action-only POST forms such as OAuth sign-in and log-out buttons are skipped.
 
 The widget appears only on the `create` forms (and their `new` pages) — sign in, sign up, password-reset request, and resend confirmation/unlock. Authenticated and edit pages such as account settings, password-reset completion, and accepting an invitation are left untouched.
 
@@ -182,7 +182,8 @@ end
 | Edit / authenticated pages (account settings, password-reset completion, accept invitation) | Not protected — the widget only appears on the `create` forms |
 | Custom controller with `skip_turnstile` (or config `skip`) | That controller/action opts out of both widget and verification |
 | No custom views | Devise's default views render; the widget still injects |
-| Custom view without a widget | The widget is injected before the submit button; Rails `button_to` action buttons are skipped |
+| Custom view without a widget | The widget is injected before the submit button if the form has a fillable field: a text, email, password, `textarea` or `select` field counts, a hidden input, checkbox, radio or file input does not |
+| Action-only POST form (OAuth sign-in, log out, delete) | No fillable field, so no widget |
 | Custom view with `cloudflare_turnstile_tag` | Your widget is used as-is; nothing is auto-injected |
 | Invisible vs visible widget | Determined by the site key's widget type in the Cloudflare dashboard |
 
@@ -194,7 +195,7 @@ Cloudflare provides dummy sitekeys and secret keys for development and testing.
 |----------|-------|----------|
 | Site Key | `1x00000000000000000000AA` | Always passes (visible) |
 | Secret Key | `1x0000000000000000000000000000000AA` | Always passes |
-| Site Key | `2x00000000000000000000AB` | Always blocks (visible) |
+| Site Key | `2x00000000000000000000AB` | Always fails (visible) |
 | Secret Key | `2x0000000000000000000000000000000AA` | Always fails |
 
 ## Development
@@ -227,7 +228,7 @@ Run RuboCop and ESLint together:
 bin/lint
 ```
 
-> **CI Note:** We run this via [.github/workflows/lint.yml](.github/workflows/lint.yml) on the latest Ruby only.
+> **CI Note:** We run `bin/lint --no-fix` via [.github/workflows/lint.yml](.github/workflows/lint.yml) on the latest Ruby only.
 
 ## Contributing
 

data/app/assets/javascripts/devise_cloudflare_turnstile.js

@@ -43,6 +43,15 @@
     }
   }
 
+  // Hidden inputs, checkboxes, radios and file inputs don't count as fillable.
+  function hasFillableField(form) {
+    var selector = 'input[type="text"], input[type="email"], input[type="password"], ' +
+      'input[type="search"], input[type="tel"], input[type="url"], ' +
+      'input[type="number"], input:not([type]), textarea, select';
+
+    return form.querySelector(selector) !== null;
+  }
+
   function renderWidget(widget) {
     if (widget.dataset.initialized || widget.childElementCount > 0) {
       return;
@@ -74,18 +83,17 @@
       return;
     }
 
-    /*
-     * Skip Rails button_to forms (rendered with class "button_to"), such as
-     * OAuth sign-in, log out, or delete buttons. They are action buttons, not
-     * user-input forms, so they should never get a Turnstile widget.
-     */
-    forms = document.querySelectorAll('form[method="post"]:not(.button_to), form[method="POST"]:not(.button_to)');
+    forms = document.querySelectorAll('form[method="post"], form[method="POST"]');
 
     for (i = 0; i < forms.length; i++) {
       form = forms[i];
       widget = form.querySelector('.' + WIDGET_CLASS);
 
       if (!widget) {
+        if (!hasFillableField(form)) {
+          continue;
+        }
+
         submit = form.querySelector('input[type="submit"], button[type="submit"], button:not([type])');
 
         if (!submit) {

data/lib/devise/cloudflare/turnstile/controller_concern.rb

@@ -10,6 +10,7 @@ module Devise
           class_attribute :_turnstile_skip_rules, instance_accessor: false
           self._turnstile_skip_rules = []
 
+          prepend_before_action :prevalidate_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :verify_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :set_turnstile_page_marker, if: :turnstile_form_action?
         end
@@ -30,23 +31,52 @@ module Devise
 
         private
 
-        def verify_cloudflare_turnstile! # rubocop:disable Metrics/AbcSize
+        # Runs ahead of the application's own filters, since any filter that
+        # reads the signed-in user lets Warden authenticate from the posted
+        # credentials. verify_cloudflare_turnstile! still renders the failure.
+        def prevalidate_cloudflare_turnstile!
+          return unless turnstile_devise_resource?
           return if turnstile_skipped?
+          return if turnstile_verified?
 
-          self.resource ||= resource_class.new
-          return if valid_turnstile?(model: resource, **turnstile_verify_options)
+          revoke_params_authentication!
+        end
 
-          restore_turnstile_submitted_values
+        def verify_cloudflare_turnstile!
+          return if turnstile_skipped?
+          return if turnstile_verified?
 
-          # Sessions (and some other Devise views) do not render resource errors.
-          # Always surface the failure via flash so the user sees feedback.
-          flash.now[:alert] = ::Cloudflare::Turnstile::Rails::ErrorMessage.default
+          revoke_params_authentication!
+          restore_turnstile_submitted_values
           clean_up_passwords(resource) if respond_to?(:clean_up_passwords, true)
           set_minimum_password_length if respond_to?(:set_minimum_password_length, true)
           set_turnstile_page_marker
           render turnstile_failure_action, status: :unprocessable_entity
         end
 
+        # Memoised because Cloudflare tokens are single use, so the early check
+        # and a direct verify_cloudflare_turnstile! call verify only once.
+        def turnstile_verified?
+          return @_turnstile_verified unless @_turnstile_verified.nil?
+
+          self.resource ||= resource_class.new
+          # No model is passed, so the failure stays out of resource.errors and is
+          # reported through the flash, scoped to the render that follows.
+          @_turnstile_verified = valid_turnstile?(flash: :now, **turnstile_verify_options)
+        end
+
+        # Devise asserts the mapping in its own prepended callback, which runs
+        # after ours. Standing down without one keeps its clearer error.
+        def turnstile_devise_resource?
+          !respond_to?(:devise_mapping, true) || !devise_mapping.nil?
+        end
+
+        # Devise's sessions#create marks the request eligible for authentication
+        # from the posted credentials, and publishes no constant for the key.
+        def revoke_params_authentication!
+          request.env.delete('devise.allow_params_authentication')
+        end
+
         # Re-populate the resource with the values the user just submitted (minus
         # passwords) so the re-rendered form keeps their input. We fail in a
         # before_action, before Devise builds the resource from params, so

data/lib/devise/cloudflare/turnstile/version.rb

@@ -1,7 +1,7 @@
 module Devise
   module Cloudflare
     module Turnstile
-      VERSION = '0.11.0'.freeze
+      VERSION = '0.12.1'.freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-cloudflare-turnstile
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.12.1
 platform: ruby
 authors:
 - Vadim Kononov
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '1.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement