devise-cloudflare-turnstile 0.12.0 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 11f41c4964063781c8e59be1c7030ce996230ece6674388be3a12cb0ebfbc1f8
-  data.tar.gz: 8da777725211daaf3d95c5ef642f52ce1dfa6cbcc09890d344614fa3e7b441de
+  metadata.gz: 471aea45843200703b848a8aacef060af2362f7103fae9f417df4f9e092bae12
+  data.tar.gz: a33a85702790274610f4580978a446037f5c468680a0128517105d14f58d9061
 SHA512:
-  metadata.gz: e28097cca5cdfe4a358980ea4d443d4a6edd761cab258efc82b22188cf2d6a08233def94e755bc0b0470db189c3f6e5898dd687671935e19ab30f26542342d7e
-  data.tar.gz: 27ea16b46b2605f5fac172e583054677bb0b2ef791ba873a672a312cee371a25b47ccc498213af58066b68b71969a210e121c2724f83f8546e43d2cdf2a190ba
+  metadata.gz: b4ada2a98896212e2b0d0c60ac5f81cbf0c56cd204c026273617eefec30aece67b114f6809d2cf81261876c6ac77c4348972dbd0abd48f3e3c7d7794697bc9da
+  data.tar.gz: e57e4598eec7ea12bfbad15dfe25855322e0b9d48cef81114b49ef5b66115c6e063f8c7b9bc28a68a5e29390a4c54c58aaf3f7eabc5eeebc000170d059ee55a9

data/lib/devise/cloudflare/turnstile/controller_concern.rb

@@ -10,6 +10,7 @@ module Devise
           class_attribute :_turnstile_skip_rules, instance_accessor: false
           self._turnstile_skip_rules = []
 
+          prepend_before_action :prevalidate_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :verify_cloudflare_turnstile!, if: :turnstile_verify_action?
           before_action :set_turnstile_page_marker, if: :turnstile_form_action?
         end
@@ -30,13 +31,20 @@ module Devise
 
         private
 
-        def verify_cloudflare_turnstile!
+        # Runs ahead of the application's own filters, since any filter that
+        # reads the signed-in user lets Warden authenticate from the posted
+        # credentials. verify_cloudflare_turnstile! still renders the failure.
+        def prevalidate_cloudflare_turnstile!
+          return unless turnstile_devise_resource?
           return if turnstile_skipped?
+          return if turnstile_verified?
 
-          self.resource ||= resource_class.new
-          # No model is passed, so the failure stays out of resource.errors and is
-          # reported through the flash, scoped to the render below.
-          return if valid_turnstile?(flash: :now, **turnstile_verify_options)
+          revoke_params_authentication!
+        end
+
+        def verify_cloudflare_turnstile!
+          return if turnstile_skipped?
+          return if turnstile_verified?
 
           revoke_params_authentication!
           restore_turnstile_submitted_values
@@ -46,10 +54,25 @@ module Devise
           render turnstile_failure_action, status: :unprocessable_entity
         end
 
+        # Memoised because Cloudflare tokens are single use, so the early check
+        # and a direct verify_cloudflare_turnstile! call verify only once.
+        def turnstile_verified?
+          return @_turnstile_verified unless @_turnstile_verified.nil?
+
+          self.resource ||= resource_class.new
+          # No model is passed, so the failure stays out of resource.errors and is
+          # reported through the flash, scoped to the render that follows.
+          @_turnstile_verified = valid_turnstile?(flash: :now, **turnstile_verify_options)
+        end
+
+        # Devise asserts the mapping in its own prepended callback, which runs
+        # after ours. Standing down without one keeps its clearer error.
+        def turnstile_devise_resource?
+          !respond_to?(:devise_mapping, true) || !devise_mapping.nil?
+        end
+
         # Devise's sessions#create marks the request eligible for authentication
-        # straight from the posted credentials. That flag outlives our halt, so
-        # any current_user call during the failure render would sign the visitor
-        # in. Devise publishes no constant for the key.
+        # from the posted credentials, and publishes no constant for the key.
         def revoke_params_authentication!
           request.env.delete('devise.allow_params_authentication')
         end

data/lib/devise/cloudflare/turnstile/version.rb

@@ -1,7 +1,7 @@
 module Devise
   module Cloudflare
     module Turnstile
-      VERSION = '0.12.0'.freeze
+      VERSION = '0.12.1'.freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-cloudflare-turnstile
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.12.1
 platform: ruby
 authors:
 - Vadim Kononov
@@ -79,7 +79,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Cloudflare Turnstile integration for Devise
 test_files: []