devise-cloudflare-turnstile 0.12.0 → 0.12.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 11f41c4964063781c8e59be1c7030ce996230ece6674388be3a12cb0ebfbc1f8
-  data.tar.gz: 8da777725211daaf3d95c5ef642f52ce1dfa6cbcc09890d344614fa3e7b441de
+  metadata.gz: 9be86bd9bc783a6287f049c134ba5267f4b78f3414f4bf8f2ec0b6d0c30b6c85
+  data.tar.gz: e0f4678b0668e47801a35f67581acf076512d74054461d1dfda44b4e80269d69
 SHA512:
-  metadata.gz: e28097cca5cdfe4a358980ea4d443d4a6edd761cab258efc82b22188cf2d6a08233def94e755bc0b0470db189c3f6e5898dd687671935e19ab30f26542342d7e
-  data.tar.gz: 27ea16b46b2605f5fac172e583054677bb0b2ef791ba873a672a312cee371a25b47ccc498213af58066b68b71969a210e121c2724f83f8546e43d2cdf2a190ba
+  metadata.gz: b212f30b5dc70e328a25a5e1a5345497c2ecdbe8a84416bf5db93d8f58bd60c4e11b322b4fd0eb7922e0baec448ff7f40473c0ca52bf71095c819c172c13b1e3
+  data.tar.gz: 4beb91ef50ca21a48b1b0f83de932eeab282802201b9edf76da70898077f10847c428d17023d070809de3c55c96af71432356d0b0bb05433f53e338a09391440

data/lib/devise/cloudflare/turnstile/configuration.rb

@@ -12,16 +12,14 @@ module Cloudflare
         end
 
         # Registers Devise controllers/actions that should not be protected.
+        # Repeated calls for the same controller accumulate.
         #
         #   config.skip :confirmations            # every action
         #   config.skip passwords: :create        # a single action
         #   config.skip unlocks: [:new, :create]  # a set of actions
         def skip(*controllers, **controller_actions)
-          controllers.each { |controller| skips[controller.to_s] = :all }
-
-          controller_actions.each do |controller, actions|
-            skips[controller.to_s] = Array(actions).map(&:to_s)
-          end
+          controllers.each { |controller| skip_named(controller) }
+          controller_actions.each { |controller, actions| skip_actions(controller.to_s, actions) }
         end
 
         def skipped?(controller_name, action_name)
@@ -31,6 +29,21 @@ module Cloudflare
 
           rule.include?(action_name.to_s)
         end
+
+        private
+
+        # Ruby 2.6 passes a string-key hash as a positional argument, not as keywords.
+        def skip_named(controller)
+          return skips[controller.to_s] = :all unless controller.is_a?(Hash)
+
+          controller.each { |name, actions| skip_actions(name.to_s, actions) }
+        end
+
+        def skip_actions(controller, actions)
+          return if skips[controller] == :all
+
+          skips[controller] = Array(skips[controller]) | Array(actions).map(&:to_s)
+        end
       end
     end
   end

data/lib/devise/cloudflare/turnstile/controller_concern.rb

@@ -10,6 +10,7 @@ module Devise
           class_attribute :_turnstile_skip_rules, instance_accessor: false
           self._turnstile_skip_rules = []
 
+          prepend_before_action :prevalidate_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :verify_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :set_turnstile_page_marker, if: :turnstile_form_action?
         end
@@ -30,13 +31,20 @@ module Devise
 
         private
 
-        def verify_cloudflare_turnstile!
+        # Runs ahead of the application's own filters, since any filter that
+        # reads the signed-in user lets Warden authenticate from the posted
+        # credentials. verify_cloudflare_turnstile! still renders the failure.
+        def prevalidate_cloudflare_turnstile!
+          return unless turnstile_devise_resource?
           return if turnstile_skipped?
+          return if turnstile_verified?
 
-          self.resource ||= resource_class.new
-          # No model is passed, so the failure stays out of resource.errors and is
-          # reported through the flash, scoped to the render below.
-          return if valid_turnstile?(flash: :now, **turnstile_verify_options)
+          revoke_params_authentication!
+        end
+
+        def verify_cloudflare_turnstile!
+          return if turnstile_skipped?
+          return if turnstile_verified?
 
           revoke_params_authentication!
           restore_turnstile_submitted_values
@@ -46,10 +54,25 @@ module Devise
           render turnstile_failure_action, status: :unprocessable_entity
         end
 
+        # Memoised because Cloudflare tokens are single use, so the early check
+        # and a direct verify_cloudflare_turnstile! call verify only once.
+        def turnstile_verified?
+          return @_turnstile_verified unless @_turnstile_verified.nil?
+
+          self.resource ||= resource_class.new
+          # No model is passed, so the failure stays out of resource.errors and is
+          # reported through the flash, scoped to the render that follows.
+          @_turnstile_verified = valid_turnstile?(flash: :now, **turnstile_verify_options)
+        end
+
+        # Devise asserts the mapping in its own prepended callback, which runs
+        # after ours. Standing down without one keeps its clearer error.
+        def turnstile_devise_resource?
+          !respond_to?(:devise_mapping, true) || !devise_mapping.nil?
+        end
+
         # Devise's sessions#create marks the request eligible for authentication
-        # straight from the posted credentials. That flag outlives our halt, so
-        # any current_user call during the failure render would sign the visitor
-        # in. Devise publishes no constant for the key.
+        # from the posted credentials, and publishes no constant for the key.
         def revoke_params_authentication!
           request.env.delete('devise.allow_params_authentication')
         end

data/lib/devise/cloudflare/turnstile/version.rb

@@ -1,7 +1,7 @@
 module Devise
   module Cloudflare
     module Turnstile
-      VERSION = '0.12.0'.freeze
+      VERSION = '0.12.2'.freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-cloudflare-turnstile
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.12.2
 platform: ruby
 authors:
 - Vadim Kononov
@@ -37,8 +37,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.0'
-description: Automatically protect Devise authentication forms with Cloudflare Turnstile,
-  without changing your Devise views or controllers.
+description: Drop-in Cloudflare Turnstile CAPTCHA, a reCAPTCHA alternative, for Devise
+  and Devise extensions. Auto-injected widget with Turbo, Turbolinks, CSP nonce and
+  i18n support.
 email:
 - vadim@konoson.com
 executables: []
@@ -79,7 +80,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.10
 specification_version: 4
-summary: Cloudflare Turnstile integration for Devise
+summary: Cloudflare Turnstile CAPTCHA for Devise with zero view or controller changes
 test_files: []