devise-cloudflare-turnstile 0.9.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 2bfd5d303bc2c0c645f0b809e2890ae0b7972d879b38a09e3f09dfe808efa6bd
+  data.tar.gz: 4acf8007cfbe3c925d342eb94c3428f0200786b6b9f7c3881291de610cf3f9da
+SHA512:
+  metadata.gz: d32017c8ceeddcdeccac77ad949fa8f1a794a7ed6e348a28db0c02e05532f728ee08f41137b0815a44a4c86f57c97edc3fe0e482100ccb1556273a7948c65e2c
+  data.tar.gz: 86c2de3bed62f852e5a2cb7f40548bf10e989fc99d64797d1ddbd287781e4df91dd3d2f8d5e216c506b62ae30f3abb2b5616518aebaf4db50da3a6f3564770ce

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Vadim Kononov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,235 @@
+# Devise Cloudflare Turnstile
+
+[![Gem Version](https://img.shields.io/gem/v/devise-cloudflare-turnstile.svg?label=Gem&logo=rubygems&logoColor=white)](https://rubygems.org/gems/devise-cloudflare-turnstile)
+[![Ruby](https://img.shields.io/badge/Ruby-2.6%20to%204.0-CC342D?logo=ruby&logoColor=white)](https://github.com/vkononov/devise-cloudflare-turnstile/blob/main/.github/workflows/test.yml)
+[![Rails](https://img.shields.io/badge/Rails-5.0%20to%208.1-D30001?logo=rubyonrails&logoColor=white)](https://github.com/vkononov/devise-cloudflare-turnstile/blob/main/Appraisals)
+[![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/devise-cloudflare-turnstile/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/devise-cloudflare-turnstile/actions/workflows/test.yml)
+[![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/devise-cloudflare-turnstile/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/devise-cloudflare-turnstile/actions/workflows/lint.yml)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+Automatically protect all Devise authentication forms with Cloudflare Turnstile. Add two helper tags to your layout, set your API keys, and every Devise form is protected — no changes to your Devise views or controllers.
+
+Built on [cloudflare-turnstile-rails](https://github.com/vkononov/cloudflare-turnstile-rails) for verification, widget rendering, CSP nonces, and Turbo support.
+
+Supports **Rails 5.0 → latest** and **Ruby 2.6 → latest**, with the full Rails/Ruby matrix tested daily in CI.
+
+[!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
+
+## Features
+
+* **No Devise view changes**: Auto-injects the Turnstile widget into Devise forms via JavaScript.
+* **Automatic verification**: Checks Turnstile on every Devise `create` action.
+* **Configurable**: Skip protection per controller or action, and set widget appearance globally.
+* **Plays well with your stack**: Devise extensions (e.g. devise-invitable), Turbo/Turbolinks re-renders, and CSP nonces all work out of the box.
+* **Built on [cloudflare-turnstile-rails](https://github.com/vkononov/cloudflare-turnstile-rails)**: verification, script loading, and i18n error messages.
+
+## Table of Contents
+
+- [Getting Started](#getting-started)
+  - [Installation](#installation)
+  - [Getting API Keys](#getting-api-keys)
+  - [How It Works](#how-it-works)
+- [Skipping Protection](#skipping-protection)
+- [Customizing the Widget](#customizing-the-widget)
+- [Passing Extra Verification Parameters](#passing-extra-verification-parameters)
+- [How Protection Is Applied](#how-protection-is-applied)
+- [Automated Testing of Your Integration](#automated-testing-of-your-integration)
+- [Development](#development)
+  - [Setup](#setup)
+  - [Running the Test Suite](#running-the-test-suite)
+  - [Code Linting](#code-linting)
+- [Contributing](#contributing)
+- [License](#license)
+
+## Getting Started
+
+### Installation
+
+Add the gem to your Gemfile:
+
+```ruby
+gem 'devise-cloudflare-turnstile'
+```
+
+Run bundle and the installer, which creates `config/initializers/cloudflare_turnstile.rb`:
+
+```bash
+bundle install
+bin/rails generate devise_cloudflare_turnstile:install
+```
+
+Add these two helpers to your layout's `<head>` (e.g. `app/views/layouts/application.html.erb`):
+
+```erb
+<%= devise_turnstile_meta_tag %>
+<%= devise_turnstile_scripts %>
+```
+
+Both render nothing on non-Devise pages, so they are safe to keep in a shared layout.
+
+Set your Cloudflare Turnstile credentials via environment variables:
+
+```bash
+export CLOUDFLARE_TURNSTILE_SITE_KEY=your_site_key
+export CLOUDFLARE_TURNSTILE_SECRET_KEY=your_secret_key
+```
+
+That's it — all Devise forms are now protected.
+
+### Getting API Keys
+
+1. Go to [Cloudflare Turnstile Dashboard](https://dash.cloudflare.com/turnstile)
+2. Create a new site
+3. Copy your Site Key and Secret Key
+
+### How It Works
+
+* **Controller** — a `before_action` on every Devise controller verifies the Turnstile response on `create` and re-renders the form with an error if it fails.
+* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button.
+
+Widget rendering, script loading, CSP nonces, and Turbo/Turbolinks handling are delegated to [cloudflare-turnstile-rails](https://github.com/vkononov/cloudflare-turnstile-rails).
+
+## Skipping Protection
+
+Both the widget and server-side verification are applied per Devise action. You can disable them globally from the initializer or per controller.
+
+### Via configuration
+
+Skip whole controllers or specific actions without creating custom controllers:
+
+```ruby
+# config/initializers/cloudflare_turnstile.rb
+Cloudflare::Turnstile::Rails.configure do |config|
+  # ...site_key, secret_key, etc...
+
+  config.skip :confirmations            # every action
+  config.skip passwords: :create        # a single action
+  config.skip unlocks: %i[new create]   # a set of actions
+end
+```
+
+Controller keys match Devise's `controller_name` (`sessions`, `registrations`, `passwords`, `confirmations`, `unlocks`, `invitations`).
+
+### Via controller macro
+
+If you already subclass a Devise controller, use the `skip_turnstile` macro:
+
+```ruby
+# app/controllers/users/passwords_controller.rb
+module Users
+  class PasswordsController < Devise::PasswordsController
+    skip_turnstile # every action
+    # skip_turnstile only: :create # a subset
+    # skip_turnstile except: :new  # everything but a subset
+  end
+end
+```
+
+Then update your routes:
+
+```ruby
+devise_for :users, controllers: { passwords: 'users/passwords' }
+```
+
+Skipping an action suppresses both the widget injection and the server-side check for that action.
+
+## Customizing the Widget
+
+Widget appearance (theme, language, size, and any other Cloudflare `data-*` option) is configured once in the initializer via the foundational gem's `config.default_data`. These defaults are applied to every auto-injected Devise widget:
+
+```ruby
+# config/initializers/cloudflare_turnstile.rb
+Cloudflare::Turnstile::Rails.configure do |config|
+  config.default_data = {
+    theme: 'dark',
+    language: -> { I18n.locale }
+  }
+end
+```
+
+To use invisible or managed widgets everywhere, configure the matching widget type on your Cloudflare site key — that choice is made in the Cloudflare dashboard, not in code.
+
+For a single form that needs different options, render a widget yourself in a custom Devise view using `cloudflare_turnstile_tag`. The injector skips any form that already contains a `.cf-turnstile` element, so your manual widget wins:
+
+```erb
+<%# app/views/users/sessions/new.html.erb %>
+<%= cloudflare_turnstile_tag data: { theme: 'light' } %>
+```
+
+## Passing Extra Verification Parameters
+
+To forward additional siteverify parameters (e.g. `remoteip`, `idempotency_key`) to Cloudflare, override `turnstile_verify_options` in a custom Devise controller:
+
+```ruby
+module Users
+  class SessionsController < Devise::SessionsController
+    private
+
+    def turnstile_verify_options
+      { remoteip: request.remote_ip }
+    end
+  end
+end
+```
+
+## How Protection Is Applied
+
+| Situation | Behavior |
+|-----------|----------|
+| No custom controllers | All Devise controllers are protected automatically |
+| Custom controller with `skip_turnstile` (or config `skip`) | That controller/action opts out of both widget and verification |
+| No custom views | Devise's default views render; the widget still injects |
+| Custom view without a widget | The widget is still injected before the submit button |
+| Custom view with `cloudflare_turnstile_tag` | Your widget is used as-is; nothing is auto-injected |
+| Invisible vs visible widget | Determined by the site key's widget type in the Cloudflare dashboard |
+
+## Automated Testing of Your Integration
+
+Cloudflare provides dummy sitekeys and secret keys for development and testing. See the [cloudflare-turnstile-rails testing docs](https://github.com/vkononov/cloudflare-turnstile-rails#automated-testing-of-your-integration) for the full matrix.
+
+| Key Type | Value | Behavior |
+|----------|-------|----------|
+| Site Key | `1x00000000000000000000AA` | Always passes (visible) |
+| Secret Key | `1x0000000000000000000000000000000AA` | Always passes |
+| Site Key | `2x00000000000000000000AB` | Always blocks (visible) |
+| Secret Key | `2x0000000000000000000000000000000AA` | Always fails |
+
+## Development
+
+### Setup
+
+Install Ruby and JavaScript dependencies in one step:
+
+```bash
+bin/setup
+npm install
+```
+
+### Running the Test Suite
+
+[Appraisal](https://github.com/thoughtbot/appraisal) is used to run the test suite against multiple Rails versions:
+
+```bash
+bundle exec appraisal install
+bundle exec appraisal rake test
+```
+
+> **CI Note:** The GitHub Action [.github/workflows/test.yml](.github/workflows/test.yml) runs this command across the supported Ruby matrix daily.
+
+### Code Linting
+
+Run RuboCop and ESLint together:
+
+```bash
+bin/lint
+```
+
+> **CI Note:** We run this via [.github/workflows/lint.yml](.github/workflows/lint.yml) on the latest Ruby only.
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/vkononov/devise-cloudflare-turnstile.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](LICENSE.txt).

data/app/assets/javascripts/devise_cloudflare_turnstile.js

@@ -0,0 +1,135 @@
+(function() {
+  'use strict';
+
+  var WIDGET_CLASS = 'cf-turnstile';
+
+  function siteKey() {
+    var meta = document.querySelector('meta[name="cf-turnstile-site-key"]');
+
+    return meta && meta.content ? meta.content : null;
+  }
+
+  function defaultData() {
+    var meta = document.querySelector('meta[name="cf-turnstile-default-data"]');
+
+    if (!meta || !meta.content) {
+      return {};
+    }
+
+    try {
+      return JSON.parse(meta.content) || {};
+    }
+    catch (e) {
+      // eslint-disable-next-line no-console
+      console.warn('devise-cloudflare-turnstile: invalid default data', e);
+
+      return {};
+    }
+  }
+
+  function applyDefaultData(widget) {
+    var data = defaultData();
+    var key;
+    var value;
+
+    for (key in data) {
+      if (Object.prototype.hasOwnProperty.call(data, key) && key !== 'sitekey') {
+        value = data[key];
+
+        if (value !== null && typeof value !== 'undefined') {
+          widget.setAttribute('data-' + key, value);
+        }
+      }
+    }
+  }
+
+  function renderWidget(widget) {
+    if (widget.dataset.initialized || widget.childElementCount > 0) {
+      return;
+    }
+
+    if (!window.turnstile) {
+      return;
+    }
+
+    try {
+      window.turnstile.render(widget);
+      widget.dataset.initialized = 'true';
+    }
+    catch (e) {
+      // eslint-disable-next-line no-console
+      console.warn('devise-cloudflare-turnstile: turnstile.render failed', e);
+    }
+  }
+
+  function injectWidgets() {
+    var key = siteKey();
+    var forms;
+    var form;
+    var widget;
+    var submit;
+    var i;
+
+    if (!key) {
+      return;
+    }
+
+    forms = document.querySelectorAll('form[method="post"], form[method="POST"]');
+
+    for (i = 0; i < forms.length; i++) {
+      form = forms[i];
+      widget = form.querySelector('.' + WIDGET_CLASS);
+
+      if (!widget) {
+        submit = form.querySelector('input[type="submit"], button[type="submit"], button:not([type])');
+
+        if (!submit) {
+          continue;
+        }
+
+        widget = document.createElement('div');
+        widget.className = WIDGET_CLASS;
+        applyDefaultData(widget);
+        widget.setAttribute('data-sitekey', key);
+        submit.parentNode.insertBefore(widget, submit);
+      }
+
+      /*
+       * Render here rather than waiting for cloudflare-turnstile-rails:
+       * on turbo:render the helper often runs before we inject the widget.
+       */
+      renderWidget(widget);
+    }
+  }
+
+  if (window._deviseTurnstileInjectorLoaded) {
+    injectWidgets();
+  }
+  else {
+    window._deviseTurnstileInjectorLoaded = true;
+
+    if (document.readyState === 'loading') {
+      document.addEventListener('DOMContentLoaded', injectWidgets);
+    }
+    else {
+      injectWidgets();
+    }
+
+    document.addEventListener('turbo:load', injectWidgets);
+    document.addEventListener('turbo:render', injectWidgets);
+    document.addEventListener('turbolinks:load', injectWidgets);
+
+    /*
+     * Same pattern as cloudflare-turnstile-rails: re-run after Turbo Streams
+     * replace DOM nodes (e.g. form re-renders).
+     */
+    document.addEventListener('turbo:before-stream-render', function(event) {
+      var originalRender = event.detail.render.bind(event.detail);
+
+      event.detail.render = function() {
+        originalRender.apply(this, arguments);
+        injectWidgets();
+      };
+    });
+  }
+}());

data/lib/devise/cloudflare/turnstile/configuration.rb

@@ -0,0 +1,37 @@
+require 'cloudflare/turnstile/rails'
+
+# Adds a Devise-aware skip registry to cloudflare-turnstile-rails'
+# configuration, so its configure block controls both the widget and which
+# Devise controllers/actions to protect.
+module Cloudflare
+  module Turnstile
+    module Rails
+      class Configuration
+        def skips
+          @skips ||= {}
+        end
+
+        # Registers Devise controllers/actions that should not be protected.
+        #
+        #   config.skip :confirmations            # every action
+        #   config.skip passwords: :create        # a single action
+        #   config.skip unlocks: [:new, :create]  # a set of actions
+        def skip(*controllers, **controller_actions)
+          controllers.each { |controller| skips[controller.to_s] = :all }
+
+          controller_actions.each do |controller, actions|
+            skips[controller.to_s] = Array(actions).map(&:to_s)
+          end
+        end
+
+        def skipped?(controller_name, action_name)
+          rule = skips[controller_name.to_s]
+          return false if rule.nil?
+          return true if rule == :all
+
+          rule.include?(action_name.to_s)
+        end
+      end
+    end
+  end
+end

data/lib/devise/cloudflare/turnstile/controller_concern.rb

@@ -0,0 +1,86 @@
+module Devise
+  module Cloudflare
+    module Turnstile
+      module ControllerConcern
+        extend ActiveSupport::Concern
+
+        included do
+          # class_attribute's `default:` keyword arrived in Rails 5.2, so set it
+          # explicitly to keep Rails 5.0/5.1 compatibility.
+          class_attribute :_turnstile_skip_rules, instance_accessor: false
+          self._turnstile_skip_rules = []
+
+          before_action :verify_cloudflare_turnstile!, only: :create
+          before_action :set_turnstile_page_marker, if: :turnstile_form_action?
+        end
+
+        module ClassMethods
+          # Disables Turnstile for this controller.
+          #
+          #   skip_turnstile                 # every action
+          #   skip_turnstile only: :create   # a subset
+          #   skip_turnstile except: :new    # everything but a subset
+          def skip_turnstile(only: nil, except: nil)
+            self._turnstile_skip_rules += [{
+              only: Array(only).map(&:to_s),
+              except: Array(except).map(&:to_s)
+            }]
+          end
+        end
+
+        private
+
+        def verify_cloudflare_turnstile! # rubocop:disable Metrics/AbcSize
+          return if turnstile_skipped?
+
+          self.resource ||= resource_class.new
+          return if valid_turnstile?(model: resource, **turnstile_verify_options)
+
+          # Sessions (and some other Devise views) do not render resource errors.
+          # Always surface the failure via flash so the user sees feedback.
+          flash.now[:alert] = ::Cloudflare::Turnstile::Rails::ErrorMessage.default
+          clean_up_passwords(resource) if respond_to?(:clean_up_passwords, true)
+          set_minimum_password_length if respond_to?(:set_minimum_password_length, true)
+          set_turnstile_page_marker
+          render turnstile_failure_action, status: :unprocessable_entity
+        end
+
+        # Extra siteverify parameters forwarded to valid_turnstile?. Override in a
+        # custom Devise controller to add e.g. remoteip: request.remote_ip.
+        def turnstile_verify_options
+          {}
+        end
+
+        def set_turnstile_page_marker
+          @_devise_turnstile_protected = true
+        end
+
+        # Include create/update so failed submissions that re-render the form
+        # still emit the Turnstile meta tag and scripts. Without this, Turbo
+        # merges a head that omits them and the widget never comes back.
+        def turnstile_form_action?
+          return false if turnstile_skipped?
+
+          action_name.in?(%w[new edit create update])
+        end
+
+        def turnstile_skipped?
+          return true if ::Cloudflare::Turnstile::Rails.configuration.skipped?(controller_name, action_name)
+
+          self.class._turnstile_skip_rules.any? { |rule| turnstile_rule_matches?(rule) }
+        end
+
+        def turnstile_rule_matches?(rule)
+          return false if rule[:except].include?(action_name)
+          return true if rule[:only].empty?
+
+          rule[:only].include?(action_name)
+        end
+
+        def turnstile_failure_action
+          action_name.in?(%w[create]) ? :new : :edit
+        end
+      end
+    end
+  end
+end

data/lib/devise/cloudflare/turnstile/engine.rb

@@ -0,0 +1,14 @@
+module Devise
+  module Cloudflare
+    module Turnstile
+      class Engine < ::Rails::Engine
+        initializer 'devise_cloudflare_turnstile.assets' do |app|
+          next unless app.config.respond_to?(:assets)
+
+          app.config.assets.paths << Devise::Cloudflare::Turnstile::Engine.root.join('app/assets/javascripts')
+          app.config.assets.precompile += %w[devise_cloudflare_turnstile.js]
+        end
+      end
+    end
+  end
+end

data/lib/devise/cloudflare/turnstile/railtie.rb

@@ -0,0 +1,19 @@
+module Devise
+  module Cloudflare
+    module Turnstile
+      class Railtie < ::Rails::Railtie
+        initializer 'devise_cloudflare_turnstile.controller_concern' do
+          ActiveSupport.on_load(:devise_controller) do
+            include Devise::Cloudflare::Turnstile::ControllerConcern
+          end
+        end
+
+        initializer 'devise_cloudflare_turnstile.view_helpers' do
+          ActiveSupport.on_load(:action_view) do
+            include Devise::Cloudflare::Turnstile::ViewHelpers
+          end
+        end
+      end
+    end
+  end
+end

data/lib/devise/cloudflare/turnstile/version.rb

@@ -0,0 +1,7 @@
+module Devise
+  module Cloudflare
+    module Turnstile
+      VERSION = '0.9.0'.freeze
+    end
+  end
+end

data/lib/devise/cloudflare/turnstile/view_helpers.rb

@@ -0,0 +1,89 @@
+require 'json'
+
+module Devise
+  module Cloudflare
+    module Turnstile
+      module ViewHelpers
+        def devise_turnstile_meta_tag
+          return unless devise_turnstile_protected?
+
+          site_key = ::Cloudflare::Turnstile::Rails.configuration.site_key
+          return if site_key.nil? || site_key.empty?
+
+          # Use the positional tag(name, options) form for Rails 5.0 compatibility
+          # (tag.meta builder API arrived in Rails 5.1). Pass options as a Hash
+          # so Ruby 3 keyword separation does not break Rails 5.0's arity.
+          safe_join(
+            [
+              tag(:meta, { name: 'cf-turnstile-site-key', content: site_key }),
+              devise_turnstile_default_data_meta_tag
+            ].compact,
+            "\n"
+          )
+        end
+
+        def devise_turnstile_scripts
+          return unless devise_turnstile_protected?
+
+          nonce = content_security_policy_nonce if respond_to?(:content_security_policy_nonce)
+
+          safe_join(
+            [
+              cloudflare_turnstile_loader(nonce),
+              cloudflare_turnstile_injector(nonce)
+            ],
+            "\n"
+          )
+        end
+
+        private
+
+        def devise_turnstile_protected?
+          @_devise_turnstile_protected
+        end
+
+        # Emits the configured default data attributes so the injector can apply
+        # them to auto-injected widgets. Procs are evaluated at render time,
+        # matching cloudflare-turnstile-rails' cloudflare_turnstile_tag behavior.
+        def devise_turnstile_default_data_meta_tag
+          data = ::Cloudflare::Turnstile::Rails.configuration.default_data || {}
+          resolved = data.each_with_object({}) do |(key, value), memo|
+            memo[key] = value.respond_to?(:call) ? value.call : value
+          end
+          return if resolved.empty?
+
+          tag(:meta, { name: 'cf-turnstile-default-data', content: JSON.generate(resolved) })
+        end
+
+        # Loads the cloudflare-turnstile-rails runtime, which fetches the
+        # Cloudflare script and renders/re-renders every ".cf-turnstile" widget
+        # (including CSP nonce and Turbo handling).
+        def cloudflare_turnstile_loader(nonce)
+          # Pass options as a Hash so Ruby 3 keyword separation works with
+          # Rails 5.0's javascript_include_tag(*sources) signature.
+          javascript_include_tag(
+            'cloudflare_turnstile_helper',
+            {
+              async: true,
+              defer: true,
+              nonce: nonce,
+              data: { 'script-url': ::Cloudflare::Turnstile::Rails.configuration.script_url }
+            }
+          )
+        end
+
+        # Injects a ".cf-turnstile" widget into every Devise form so no view
+        # changes are required; rendering is delegated to the runtime above.
+        def cloudflare_turnstile_injector(nonce)
+          javascript_include_tag(
+            'devise_cloudflare_turnstile',
+            {
+              defer: true,
+              nonce: nonce
+            }
+          )
+        end
+      end
+    end
+  end
+end

data/lib/devise/cloudflare/turnstile.rb

@@ -0,0 +1,9 @@
+require 'devise'
+require 'cloudflare/turnstile/rails'
+
+require_relative 'turnstile/version'
+require_relative 'turnstile/configuration'
+require_relative 'turnstile/controller_concern'
+require_relative 'turnstile/view_helpers'
+require_relative 'turnstile/engine'
+require_relative 'turnstile/railtie'

data/lib/generators/devise_cloudflare_turnstile/install_generator.rb

@@ -0,0 +1,50 @@
+require 'rails/generators'
+require 'generators/cloudflare_turnstile/install_generator'
+
+module DeviseCloudflareTurnstile
+  class InstallGenerator < Rails::Generators::Base
+    source_root File.expand_path('templates', __dir__)
+
+    INITIALIZER = 'config/initializers/cloudflare_turnstile.rb'.freeze
+
+    desc 'Creates the Cloudflare Turnstile initializer with Devise-specific options'
+
+    def check_dependencies
+      return if File.exist?(File.join(destination_root, 'config/initializers/devise.rb'))
+
+      say_status :error, 'Devise not installed. Run: rails generate devise:install', :red
+      raise SystemExit
+    end
+
+    def create_initializer
+      create_file INITIALIZER, combined_initializer
+    end
+
+    def show_layout_instructions
+      say "\nAdd these helpers to your layout's <head> (e.g. app/views/layouts/application.html.erb):", :green
+      say <<~ERB
+
+        <%= devise_turnstile_meta_tag %>
+        <%= devise_turnstile_scripts %>
+      ERB
+    end
+
+    private
+
+    # Reuses cloudflare-turnstile-rails' initializer verbatim (single source of
+    # truth) and injects our Devise-specific options into its config block,
+    # indented to match. Add new options by editing templates/devise_options.rb.
+    def combined_initializer
+      foundational_initializer.sub(/\nend\s*\z/, "\n\n#{devise_options}end\n")
+    end
+
+    def foundational_initializer
+      template = File.expand_path('cloudflare_turnstile.rb', CloudflareTurnstile::Generators::InstallGenerator.source_root)
+      File.read(template)
+    end
+
+    def devise_options
+      File.read(File.expand_path('devise_options.rb', self.class.source_root)).gsub(/^(?=.)/, '  ')
+    end
+  end
+end

data/lib/generators/devise_cloudflare_turnstile/templates/devise_options.rb

@@ -0,0 +1,4 @@
+# Disable Turnstile for specific Devise controllers or actions.
+# config.skip :confirmations            # every action
+# config.skip passwords: :create        # a single action
+# config.skip unlocks: [:new, :create]  # a set of actions

metadata

@@ -0,0 +1,85 @@
+--- !ruby/object:Gem::Specification
+name: devise-cloudflare-turnstile
+version: !ruby/object:Gem::Version
+  version: 0.9.0
+platform: ruby
+authors:
+- Vadim Kononov
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: cloudflare-turnstile-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.1'
+- !ruby/object:Gem::Dependency
+  name: devise
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.0'
+description: Automatically protect Devise authentication forms with Cloudflare Turnstile,
+  without changing your Devise views or controllers.
+email:
+- vadim@konoson.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE.txt
+- README.md
+- app/assets/javascripts/devise_cloudflare_turnstile.js
+- lib/devise/cloudflare/turnstile.rb
+- lib/devise/cloudflare/turnstile/configuration.rb
+- lib/devise/cloudflare/turnstile/controller_concern.rb
+- lib/devise/cloudflare/turnstile/engine.rb
+- lib/devise/cloudflare/turnstile/railtie.rb
+- lib/devise/cloudflare/turnstile/version.rb
+- lib/devise/cloudflare/turnstile/view_helpers.rb
+- lib/generators/devise_cloudflare_turnstile/install_generator.rb
+- lib/generators/devise_cloudflare_turnstile/templates/devise_options.rb
+homepage: https://github.com/vkononov/devise-cloudflare-turnstile
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/vkononov/devise-cloudflare-turnstile
+  source_code_uri: https://github.com/vkononov/devise-cloudflare-turnstile
+  changelog_uri: https://github.com/vkononov/devise-cloudflare-turnstile/releases
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.6.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.10
+specification_version: 4
+summary: Cloudflare Turnstile integration for Devise
+test_files: []