devise-cloudflare-turnstile 0.10.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b29bbe949d442bee08751e705b15350414748639b11d73296b84647a3492325e
-  data.tar.gz: 11159165db1ab0a0b9d1f3d09367c2ece59eff3d2fb875b1f84bd465be37c43e
+  metadata.gz: 95edf74912abe68de902d9a5e3cf58c59f8f44d3a60f0b5cfb3ac6105e981ff6
+  data.tar.gz: b01582121ba114a8044e010fcd782e8baca8100a220150c4eb6dc2f85af9ac7d
 SHA512:
-  metadata.gz: 9323f0c853e494ff79d6c1a7e02e0918e1931072a147c3fbeec1424bdc4966fdaeb34ae75fb333b605f28b22238416c728ba24638467b27380a17ac93ac70e82
-  data.tar.gz: ce5cf4f403126a3a8ac08fb8613ddeb300f21085aa0e47cf20a195cd78a3930fe0207ac12b530c4c0c53d936646247667a1cf5a9ccfaf70505824386fed4bc46
+  metadata.gz: dc8dba667dcec474d7464faa259cccc99abaa45823fcedfe26520098ede8b9fd4c78a0849cf0c0e03b85550e0f7cd2527a55c7d60628ba0f243f17aa7074e0ee
+  data.tar.gz: 05ccb44987629b192af3087fcbe463989b30791f31526c3f8c134dc49e45cf5d6e79b7d44dba4de5d948b3ddc23ba55fa6da1ef18a56cfbfdcab9113691860cf

data/README.md

@@ -85,7 +85,9 @@ That's it — all Devise forms are now protected.
 ### How It Works
 
 * **Controller** — a `before_action` on every Devise controller verifies the Turnstile response on `create` and re-renders the form with an error if it fails.
-* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button.
+* **View** — on Devise form pages, the two layout helpers emit the site key and load the injector JavaScript, which adds a `cf-turnstile` widget before each submit button. Rails `button_to` action buttons (e.g. OAuth sign-in or log out) are skipped.
+
+The widget appears only on the `create` forms (and their `new` pages) — sign in, sign up, password-reset request, and resend confirmation/unlock. Authenticated and edit pages such as account settings, password-reset completion, and accepting an invitation are left untouched.
 
 Widget rendering, script loading, CSP nonces, and Turbo/Turbolinks handling are delegated to [cloudflare-turnstile-rails](https://github.com/vkononov/cloudflare-turnstile-rails).
 
@@ -176,10 +178,11 @@ end
 
 | Situation | Behavior |
 |-----------|----------|
-| No custom controllers | All Devise controllers are protected automatically |
+| No custom controllers | All Devise controllers are protected automatically on their `create` actions |
+| Edit / authenticated pages (account settings, password-reset completion, accept invitation) | Not protected — the widget only appears on the `create` forms |
 | Custom controller with `skip_turnstile` (or config `skip`) | That controller/action opts out of both widget and verification |
 | No custom views | Devise's default views render; the widget still injects |
-| Custom view without a widget | The widget is still injected before the submit button |
+| Custom view without a widget | The widget is injected before the submit button; Rails `button_to` action buttons are skipped |
 | Custom view with `cloudflare_turnstile_tag` | Your widget is used as-is; nothing is auto-injected |
 | Invisible vs visible widget | Determined by the site key's widget type in the Cloudflare dashboard |
 

data/app/assets/javascripts/devise_cloudflare_turnstile.js

@@ -74,7 +74,12 @@
       return;
     }
 
-    forms = document.querySelectorAll('form[method="post"], form[method="POST"]');
+    /*
+     * Skip Rails button_to forms (rendered with class "button_to"), such as
+     * OAuth sign-in, log out, or delete buttons. They are action buttons, not
+     * user-input forms, so they should never get a Turnstile widget.
+     */
+    forms = document.querySelectorAll('form[method="post"]:not(.button_to), form[method="POST"]:not(.button_to)');
 
     for (i = 0; i < forms.length; i++) {
       form = forms[i];

data/lib/devise/cloudflare/turnstile/controller_concern.rb

@@ -10,7 +10,7 @@ module Devise
           class_attribute :_turnstile_skip_rules, instance_accessor: false
           self._turnstile_skip_rules = []
 
-          before_action :verify_cloudflare_turnstile!, only: :create
+          before_action :verify_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :set_turnstile_page_marker, if: :turnstile_form_action?
         end
 
@@ -85,13 +85,21 @@ module Devise
           @_devise_turnstile_protected = true
         end
 
-        # Include create/update so failed submissions that re-render the form
-        # still emit the Turnstile meta tag and scripts. Without this, Turbo
-        # merges a head that omits them and the widget never comes back.
+        # Verify only on create. Kept as a predicate rather than `only: :create`
+        # so the callback is skipped cleanly on controllers without a create
+        # action instead of raising.
+        def turnstile_verify_action?
+          action_name == 'create'
+        end
+
+        # The widget shows on the create forms (`new`) and on `create` itself, so
+        # a failed submission that re-renders still emits the meta tag and scripts
+        # that Turbo needs. Edit/update pages are excluded because only `create`
+        # is verified.
         def turnstile_form_action?
           return false if turnstile_skipped?
 
-          action_name.in?(%w[new edit create update])
+          action_name.in?(%w[new create])
         end
 
         def turnstile_skipped?

data/lib/devise/cloudflare/turnstile/version.rb

@@ -1,7 +1,7 @@
 module Devise
   module Cloudflare
     module Turnstile
-      VERSION = '0.10.0'.freeze
+      VERSION = '0.11.0'.freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-cloudflare-turnstile
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.11.0
 platform: ruby
 authors:
 - Vadim Kononov