devise-cloudflare-turnstile 0.9.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bfd5d303bc2c0c645f0b809e2890ae0b7972d879b38a09e3f09dfe808efa6bd
-  data.tar.gz: 4acf8007cfbe3c925d342eb94c3428f0200786b6b9f7c3881291de610cf3f9da
+  metadata.gz: 95edf74912abe68de902d9a5e3cf58c59f8f44d3a60f0b5cfb3ac6105e981ff6
+  data.tar.gz: b01582121ba114a8044e010fcd782e8baca8100a220150c4eb6dc2f85af9ac7d
 SHA512:
-  metadata.gz: d32017c8ceeddcdeccac77ad949fa8f1a794a7ed6e348a28db0c02e05532f728ee08f41137b0815a44a4c86f57c97edc3fe0e482100ccb1556273a7948c65e2c
-  data.tar.gz: 86c2de3bed62f852e5a2cb7f40548bf10e989fc99d64797d1ddbd287781e4df91dd3d2f8d5e216c506b62ae30f3abb2b5616518aebaf4db50da3a6f3564770ce
+  metadata.gz: dc8dba667dcec474d7464faa259cccc99abaa45823fcedfe26520098ede8b9fd4c78a0849cf0c0e03b85550e0f7cd2527a55c7d60628ba0f243f17aa7074e0ee
+  data.tar.gz: 05ccb44987629b192af3087fcbe463989b30791f31526c3f8c134dc49e45cf5d6e79b7d44dba4de5d948b3ddc23ba55fa6da1ef18a56cfbfdcab9113691860cf

data/README.md

@@ -85,7 +85,9 @@ That's it — all Devise forms are now protected.
 ### How It Works
 
 * **Controller** — a `before_action` on every Devise controller verifies the Turnstile response on `create` and re-renders the form with an error if it fails.
-* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button.
+* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button. Rails `button_to` action buttons (e.g. OAuth sign-in or log out) are skipped.
+
+The widget appears only on the `create` forms (and their `new` pages) — sign in, sign up, password-reset request, and resend confirmation/unlock. Authenticated and edit pages such as account settings, password-reset completion, and accepting an invitation are left untouched.
 
 Widget rendering, script loading, CSP nonces, and Turbo/Turbolinks handling are delegated to [cloudflare-turnstile-rails](https://github.com/vkononov/cloudflare-turnstile-rails).
 
@@ -176,10 +178,11 @@ end
 
 | Situation | Behavior |
 |-----------|----------|
-| No custom controllers | All Devise controllers are protected automatically |
+| No custom controllers | All Devise controllers are protected automatically on their `create` actions |
+| Edit / authenticated pages (account settings, password-reset completion, accept invitation) | Not protected — the widget only appears on the `create` forms |
 | Custom controller with `skip_turnstile` (or config `skip`) | That controller/action opts out of both widget and verification |
 | No custom views | Devise's default views render; the widget still injects |
-| Custom view without a widget | The widget is still injected before the submit button |
+| Custom view without a widget | The widget is injected before the submit button; Rails `button_to` action buttons are skipped |
 | Custom view with `cloudflare_turnstile_tag` | Your widget is used as-is; nothing is auto-injected |
 | Invisible vs visible widget | Determined by the site key's widget type in the Cloudflare dashboard |
 

data/app/assets/javascripts/devise_cloudflare_turnstile.js

@@ -74,7 +74,12 @@
       return;
     }
 
-    forms = document.querySelectorAll('form[method="post"], form[method="POST"]');
+    /*
+     * Skip Rails button_to forms (rendered with class "button_to"), such as
+     * OAuth sign-in, log out, or delete buttons. They are action buttons, not
+     * user-input forms, so they should never get a Turnstile widget.
+     */
+    forms = document.querySelectorAll('form[method="post"]:not(.button_to), form[method="POST"]:not(.button_to)');
 
     for (i = 0; i < forms.length; i++) {
       form = forms[i];

data/lib/devise/cloudflare/turnstile/controller_concern.rb

@@ -10,7 +10,7 @@ module Devise
           class_attribute :_turnstile_skip_rules, instance_accessor: false
           self._turnstile_skip_rules = []
 
-          before_action :verify_cloudflare_turnstile!, only: :create
+          before_action :verify_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :set_turnstile_page_marker, if: :turnstile_form_action?
         end
 
@@ -36,6 +36,8 @@ module Devise
           self.resource ||= resource_class.new
           return if valid_turnstile?(model: resource, **turnstile_verify_options)
 
+          restore_turnstile_submitted_values
+
           # Sessions (and some other Devise views) do not render resource errors.
           # Always surface the failure via flash so the user sees feedback.
           flash.now[:alert] = ::Cloudflare::Turnstile::Rails::ErrorMessage.default
@@ -45,6 +47,34 @@ module Devise
           render turnstile_failure_action, status: :unprocessable_entity
         end
 
+        # Re-populate the resource with the values the user just submitted (minus
+        # passwords) so the re-rendered form keeps their input. We fail in a
+        # before_action, before Devise builds the resource from params, so
+        # without this the form would come back blank. Assigning to the
+        # in-memory resource is safe because the request halts here and the
+        # record is never saved.
+        def restore_turnstile_submitted_values
+          return unless respond_to?(:resource_name, true)
+
+          submitted = params[resource_name]
+          return unless submitted.respond_to?(:each_pair)
+
+          submitted.each_pair do |field, value|
+            next if field.to_s.include?('password')
+            next unless turnstile_scalar_value?(value)
+
+            setter = "#{field}="
+            resource.public_send(setter, value) if resource.respond_to?(setter)
+          end
+        end
+
+        # Limits restoration to simple form values. Nested params (e.g. arrays or
+        # *_attributes hashes) are skipped because assigning them to the resource
+        # is error-prone, and Devise forms only use scalar fields anyway.
+        def turnstile_scalar_value?(value)
+          value.is_a?(String) || value.is_a?(Numeric) || [true, false].include?(value)
+        end
+
         # Extra siteverify parameters forwarded to valid_turnstile?. Override in a
         # custom Devise controller to add e.g. remoteip: request.remote_ip.
         def turnstile_verify_options
@@ -55,13 +85,21 @@ module Devise
           @_devise_turnstile_protected = true
         end
 
-        # Include create/update so failed submissions that re-render the form
-        # still emit the Turnstile meta tag and scripts. Without this, Turbo
-        # merges a head that omits them and the widget never comes back.
+        # Verify only on create. Kept as a predicate rather than `only: :create`
+        # so the callback is skipped cleanly on controllers without a create
+        # action instead of raising.
+        def turnstile_verify_action?
+          action_name == 'create'
+        end
+
+        # The widget shows on the create forms (`new`) and on `create` itself, so
+        # a failed submission that re-renders still emits the meta tag and scripts
+        # that Turbo needs. Edit/update pages are excluded because only `create`
+        # is verified.
         def turnstile_form_action?
           return false if turnstile_skipped?
 
-          action_name.in?(%w[new edit create update])
+          action_name.in?(%w[new create])
         end
 
         def turnstile_skipped?

data/lib/devise/cloudflare/turnstile/version.rb

@@ -1,7 +1,7 @@
 module Devise
   module Cloudflare
     module Turnstile
-      VERSION = '0.9.0'.freeze
+      VERSION = '0.11.0'.freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-cloudflare-turnstile
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.11.0
 platform: ruby
 authors:
 - Vadim Kononov