devise-cloudflare-turnstile 0.9.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bfd5d303bc2c0c645f0b809e2890ae0b7972d879b38a09e3f09dfe808efa6bd
-  data.tar.gz: 4acf8007cfbe3c925d342eb94c3428f0200786b6b9f7c3881291de610cf3f9da
+  metadata.gz: b29bbe949d442bee08751e705b15350414748639b11d73296b84647a3492325e
+  data.tar.gz: 11159165db1ab0a0b9d1f3d09367c2ece59eff3d2fb875b1f84bd465be37c43e
 SHA512:
-  metadata.gz: d32017c8ceeddcdeccac77ad949fa8f1a794a7ed6e348a28db0c02e05532f728ee08f41137b0815a44a4c86f57c97edc3fe0e482100ccb1556273a7948c65e2c
-  data.tar.gz: 86c2de3bed62f852e5a2cb7f40548bf10e989fc99d64797d1ddbd287781e4df91dd3d2f8d5e216c506b62ae30f3abb2b5616518aebaf4db50da3a6f3564770ce
+  metadata.gz: 9323f0c853e494ff79d6c1a7e02e0918e1931072a147c3fbeec1424bdc4966fdaeb34ae75fb333b605f28b22238416c728ba24638467b27380a17ac93ac70e82
+  data.tar.gz: ce5cf4f403126a3a8ac08fb8613ddeb300f21085aa0e47cf20a195cd78a3930fe0207ac12b530c4c0c53d936646247667a1cf5a9ccfaf70505824386fed4bc46

data/lib/devise/cloudflare/turnstile/controller_concern.rb

@@ -36,6 +36,8 @@ module Devise
           self.resource ||= resource_class.new
           return if valid_turnstile?(model: resource, **turnstile_verify_options)
 
+          restore_turnstile_submitted_values
+
           # Sessions (and some other Devise views) do not render resource errors.
           # Always surface the failure via flash so the user sees feedback.
           flash.now[:alert] = ::Cloudflare::Turnstile::Rails::ErrorMessage.default
@@ -45,6 +47,34 @@ module Devise
           render turnstile_failure_action, status: :unprocessable_entity
         end
 
+        # Re-populate the resource with the values the user just submitted (minus
+        # passwords) so the re-rendered form keeps their input. We fail in a
+        # before_action, before Devise builds the resource from params, so
+        # without this the form would come back blank. Assigning to the
+        # in-memory resource is safe because the request halts here and the
+        # record is never saved.
+        def restore_turnstile_submitted_values
+          return unless respond_to?(:resource_name, true)
+
+          submitted = params[resource_name]
+          return unless submitted.respond_to?(:each_pair)
+
+          submitted.each_pair do |field, value|
+            next if field.to_s.include?('password')
+            next unless turnstile_scalar_value?(value)
+
+            setter = "#{field}="
+            resource.public_send(setter, value) if resource.respond_to?(setter)
+          end
+        end
+
+        # Limits restoration to simple form values. Nested params (e.g. arrays or
+        # *_attributes hashes) are skipped because assigning them to the resource
+        # is error-prone, and Devise forms only use scalar fields anyway.
+        def turnstile_scalar_value?(value)
+          value.is_a?(String) || value.is_a?(Numeric) || [true, false].include?(value)
+        end
+
         # Extra siteverify parameters forwarded to valid_turnstile?. Override in a
         # custom Devise controller to add e.g. remoteip: request.remote_ip.
         def turnstile_verify_options

data/lib/devise/cloudflare/turnstile/version.rb

@@ -1,7 +1,7 @@
 module Devise
   module Cloudflare
     module Turnstile
-      VERSION = '0.9.0'.freeze
+      VERSION = '0.10.0'.freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-cloudflare-turnstile
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.10.0
 platform: ruby
 authors:
 - Vadim Kononov