lato 3.13.22 → 3.14.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f16c35af0be4d43d484046b852f69b6525462ccf2418706831b2ee57f1deef52
-  data.tar.gz: 319880bcee1c7d0f62211e92f0e6d295ebbd4d6ff963d92bfecb6b497e2afcc8
+  metadata.gz: f450b06c122aa90052b575bf771f8d8e9fc91415cb51b10eeee2226c923764f2
+  data.tar.gz: '0892dd3937fbd9b5cb904fc0629cd9db9fc373554d0e82e2e565d8fa75b88920'
 SHA512:
-  metadata.gz: eee9cceeaf4be79aeaa98f4dee005c0103c10700dfaca990a89f6dd8df3e68cf29804302d3dc57aa99535c69788027ad493173989a0e09b06c346873b65bab44
-  data.tar.gz: 6a0f326170115f10d1d306e11eed3ec6624ad4ecbeb5209bd5f0227a605de5b24cd8d49094c537f9475552890845a29e33e1b51c1014715e34bb376d369e371b
+  metadata.gz: dabfd2a98a70c24e7b45e44e5091bbf762a8bdb01b59bc8db16dccb69aeea871ca22f97c2eb1fa41cc27aa3c981c176b705762d81b796269678abba4ce02982d
+  data.tar.gz: 69f7d3ee59dbd2d031564a8cbd8e14c072e0267c57747fe829c95d95f99b15d2a76af1150bcc503e76377a2ee1480ebd6fe2396374336817548d6d22ba2074b2

data/app/assets/javascripts/lato/controllers/lato_hcaptcha_controller.js

@@ -0,0 +1,22 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  connect() {
+    this.loadHCaptcha()
+  }
+
+  loadHCaptcha() {
+    if (window.hcaptcha) {
+      window.hcaptcha.render(this.element)
+    } else {
+      const script = document.createElement('script')
+      script.src = 'https://js.hcaptcha.com/1/api.js?onload=hcaptchaOnLoad&render=explicit'
+      script.async = true
+      script.defer = true
+      window.hcaptchaOnLoad = () => {
+        window.hcaptcha.render(this.element)
+      }
+      document.head.appendChild(script)
+    }
+  }
+}

data/app/controllers/lato/authentication_controller.rb

@@ -82,6 +82,7 @@ module Lato
 
     def signup_action
       @user = Lato::User.new(registration_params)
+      return unless verify_hcaptcha(:signup)
 
       respond_to do |format|
         if @user.signup(ip_address: request.remote_ip, user_agent: request.user_agent)
@@ -265,5 +266,44 @@ module Lato
 
       respond_to_with_not_found
     end
+
+    def verify_hcaptcha(render_key)
+      return true unless Lato.config.hcaptcha_site_key && Lato.config.hcaptcha_secret
+
+      # Per compatibilità con i vari endpoint, istanzia @user se non esiste
+      @user ||= Lato::User.new
+
+      hcaptcha_response = params["h-captcha-response"]
+      if hcaptcha_response.blank?
+        @user.errors.add(:base, "hCaptcha response is missing")
+        respond_to do |format|
+          format.html { render render_key, status: :unprocessable_entity }
+          format.json { render json: @user.errors, status: :unprocessable_entity }
+        end
+        return false
+      end
+
+      require 'net/http'
+      require 'uri'
+      require 'json'
+      uri = URI.parse("https://hcaptcha.com/siteverify")
+      response = Net::HTTP.post_form(uri, {
+        "secret" => Lato.config.hcaptcha_secret,
+        "response" => hcaptcha_response,
+        "remoteip" => request.remote_ip
+      })
+      result = JSON.parse(response.body)
+      Rails.logger.info("[hCaptcha] Verification result: #{result}")
+      unless result["success"]
+        @user.errors.add(:base, "hCaptcha verification failed")
+        respond_to do |format|
+          format.html { render render_key, status: :unprocessable_entity }
+          format.json { render json: @user.errors, status: :unprocessable_entity }
+        end
+        return false
+      end
+
+      true
+    end
   end
 end

data/app/views/lato/authentication/_form-signup.html.erb

@@ -10,6 +10,8 @@ user ||= Lato::User.new
     
     <%= render 'lato/authentication/fields-registration', form: form %>
 
+    <%= render 'lato/authentication/hcaptcha' %>
+
     <div class="d-flex justify-content-end">
       <%= lato_form_submit form, I18n.t('lato.signup') %>
     </div>

data/app/views/lato/authentication/_hcaptcha.html.erb

@@ -0,0 +1,5 @@
+<% if Lato.config.hcaptcha_site_key && Lato.config.hcaptcha_secret %>
+  <div class="mb-3 d-flex justify-content-center">
+  <div class="h-captcha" data-controller="lato-hcaptcha" data-sitekey="<%= Lato.config.hcaptcha_site_key %>"></div>
+  </div>
+<% end %>

data/lib/lato/config.rb

@@ -12,6 +12,9 @@ module Lato
     # Authentication configs
     attr_accessor :auth_disable_signup, :auth_disable_recover_password, :auth_disable_web3, :auth_disable_authenticator
 
+    # Hcaptcha configs
+    attr_accessor :hcaptcha_site_key, :hcaptcha_secret
+
     # Assets configs
     attr_accessor :assets_stylesheet_entry
     attr_accessor :assets_importmap_entry
@@ -40,6 +43,9 @@ module Lato
       @auth_disable_recover_password = false
       @auth_disable_web3 = false
       @auth_disable_authenticator = false
+      
+      @hcaptcha_site_key = nil
+      @hcaptcha_secret = nil
 
       @assets_stylesheet_entry = 'application'
       @assets_importmap_entry = 'application'

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.13.22"
+  VERSION = "3.14.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lato
 version: !ruby/object:Gem::Version
-  version: 3.13.22
+  version: 3.14.1
 platform: ruby
 authors:
 - Gregorio Galante
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-07-31 00:00:00.000000000 Z
+date: 2025-08-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -162,6 +162,7 @@ files:
 - app/assets/javascripts/lato/controllers/lato_feedback_controller.js
 - app/assets/javascripts/lato/controllers/lato_form_controller.js
 - app/assets/javascripts/lato/controllers/lato_guide_controller.js
+- app/assets/javascripts/lato/controllers/lato_hcaptcha_controller.js
 - app/assets/javascripts/lato/controllers/lato_hello_controller.js
 - app/assets/javascripts/lato/controllers/lato_index_controller.js
 - app/assets/javascripts/lato/controllers/lato_input_autocomplete2_controller.js
@@ -211,6 +212,7 @@ files:
 - app/views/lato/authentication/_form-update-password.html.erb
 - app/views/lato/authentication/_form-verify-email.html.erb
 - app/views/lato/authentication/_form-web3-signin.html.erb
+- app/views/lato/authentication/_hcaptcha.html.erb
 - app/views/lato/authentication/accept_invitation.html.erb
 - app/views/lato/authentication/authenticator.html.erb
 - app/views/lato/authentication/recover_password.html.erb