otori 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8918f6c816e04317efede4302afa940ac592e92f6a4e8499bd81f9adbee536f0
-  data.tar.gz: c2659d173281ef798d54c52bcd2967dab83d971e3eb662db1ba214565824365a
+  metadata.gz: dad6a295086cd2eb7abd60f81e264cde80726e6802deec8e185b3d6ddd2bd082
+  data.tar.gz: b1fe5bab67f24f249b9b45055fa0a632774b99fa93fe0c156235014c9bdf1416
 SHA512:
-  metadata.gz: fbfb505eb0362b440bdbd0b86f53395dc4f3c1ff059e6446d2d7c8466c93c27f25e9b05889c62962292315bda17fcd09b5b98c434ed613e8bc5858fdf713ca89
-  data.tar.gz: a975548f46af0ec0ceb9d59fb73ef20a175211016156253414676e292f4c08d4b86fa7208aab98ed92ca42b61fc54e97b71f1ddc519dcebeaa61d6fc6b968216
+  metadata.gz: a275bbc1f3a7ce4a3f8ae0b6a09b0835aeeca30713254819f747e3e3b06f0c2e8a875a6ca604a8df396ada100ce9518238e8575ec1a06a3bb06e2bec5abe8b5d
+  data.tar.gz: 7fee9a413435e3efcf65f5196fdffe168c664935c8e1390f06545cb9f650571e47e031f04f3f9f2649f01a0b62a67229a9e7071199bdc2903c3dfe1543e625f1

data/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-09-17
+
+### Added
+
+- `Otori::Rails`, an optional adapter for Rails apps. Provides a
+  `honeypot` controller class macro that registers a `before_action`
+  (halting with `:no_content` by default, or running a user-supplied
+  block), and a `honeypot_field` / `honeypot_signals` view-helper pair.
+  Loaded via `require "otori/rails"`; auto-hooks via a Railtie when
+  present.
+
+## [0.1.0] - 2026-05-22
+
 ### Added
 
 - Initial scaffolding inspired by the

data/README.md

@@ -3,8 +3,11 @@
 [![CI](https://codeberg.org/fluck/otori/actions/workflows/ci.yml/badge.svg)](https://codeberg.org/fluck/otori/actions?workflow=ci.yml)
 [![Version](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcodeberg.org%2Fapi%2Fv1%2Frepos%2Ffluck%2Fotori%2Ftags&query=%24%5B0%5D.name&label=version)](https://codeberg.org/fluck/otori/tags)
 
-Invisible captcha spam protection for any Rack-based Ruby app, with an opt-in
-Hanami adapter.
+Invisible honeypot spam protection for Hanami, Sinatra, Roda, Rails, and any
+other Rack-based Ruby app. Think of it as a framework-agnostic
+[invisible_captcha](https://github.com/markets/invisible_captcha) with a
+first-class Hanami adapter and an extra layer of JavaScript-based input
+detection.
 
 _Otori_ (囮) is the Japanese word for "decoy", historically a bird used in
 hunting to draw others in.
@@ -26,6 +29,29 @@ or flag submissions at a chosen _human rating_ threshold.
 > [Codeberg](https://codeberg.org/fluck/otori). The [GitHub
 > repo](https://github.com/flucksite/otori) is just a mirror.
 
+## How it compares
+
+### otori
+
+- Frameworks: Hanami, Sinatra, Roda, Rails, any Rack app
+- Hidden field + timing check + JS input signals
+- Active (new in 2026)
+
+### [invisible_captcha](https://github.com/markets/invisible_captcha)
+
+- Frameworks: Rails only
+- Hidden field + timing check
+- Actively maintained
+
+### [rack-honeypot](https://github.com/sunlightlabs/rack-honeypot)
+
+- Frameworks: any Rack app
+- Hidden field only
+- Dormant since 2016
+
+If you're on Rails and don't need the JS signals layer, `invisible_captcha` is
+the more battle-tested choice. Otori exists for everything else.
+
 ## Installation
 
 Add this to your Gemfile:
@@ -174,46 +200,54 @@ In the view:
 
 ### Rails
 
-Rails is well served by [invisible_captcha](https://github.com/markets/invisible_captcha)
-when all you need is a hidden field and a timing check. Use this gem in Rails
-if you want the input-signals rating on top.
+Load the Rails adapter from your Gemfile so the Railtie auto-hooks the
+controller macros and view helpers:
 
 ```ruby
-# app/helpers/application_helper.rb
-module ApplicationHelper
-  def honeypot_field(name, **attrs)
-    Otori.field(name, session: session, **attrs).html_safe
-  end
+gem "otori", require: "otori/rails"
+```
 
-  def honeypot_signals(**attrs)
-    Otori.signals_field(**attrs).html_safe
-  end
-end
+In a form template:
+
+```erb
+<%= honeypot_field("user[website]") %>
+<%= honeypot_signals %>
 ```
 
+Guard the receiving action with the `honeypot` class macro:
+
 ```ruby
-# app/controllers/sign_ups_controller.rb
 class SignUpsController < ApplicationController
-  before_action :check_honeypot, only: :create
+  honeypot :website, wait: 2, only: :create
 
   def create
     # ...
   end
+end
+```
 
-  private
+When the honeypot is tripped, the request halts with `:no_content` by default.
+To customize the response, pass a block:
 
-  def check_honeypot
-    return unless Otori.caught?(
-      "user[website]",
-      params: params.to_unsafe_h,
-      session: session
-    )
+```ruby
+honeypot :website, only: :create do
+  redirect_to root_path, notice: "Moving on..."
+end
+```
 
-    head :no_content
-  end
+To act on the input-signals rating inside the action:
+
+```ruby
+def create
+  rating = Otori.signals_rating(params)
+  # weight into your own scoring, or reject below a threshold
 end
 ```
 
+The adapter is a thin wrapper over the framework-agnostic core; if you prefer
+to wire it up manually, `Otori.caught?` and `Otori.field` still work fine
+inside a `before_action` and a helper method.
+
 ## Configuration
 
 ```ruby

data/lib/otori/rails.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative "../otori"
+
+module Otori
+  module Rails
+    module ControllerMacros
+      def honeypot(name, wait: nil, only: nil, except: nil, &on_caught)
+        filter_options = {}
+        filter_options[:only] = only if only
+        filter_options[:except] = except if except
+
+        before_action(**filter_options) do
+          next unless Otori.caught?(
+            name,
+            params:,
+            session:,
+            wait:
+          )
+
+          if on_caught
+            instance_exec(&on_caught)
+          else
+            head :no_content
+          end
+        end
+      end
+    end
+
+    module Helpers
+      def honeypot_field(name, **attrs)
+        Otori.field(name, session: session, **attrs).html_safe
+      end
+
+      def honeypot_signals(**attrs)
+        Otori.signals_field(**attrs).html_safe
+      end
+    end
+
+    if defined?(::Rails::Railtie)
+      class Railtie < ::Rails::Railtie
+        initializer "otori.action_controller" do
+          ActiveSupport.on_load(:action_controller) do
+            extend Otori::Rails::ControllerMacros
+          end
+        end
+
+        initializer "otori.action_view" do
+          ActiveSupport.on_load(:action_view) do
+            include Otori::Rails::Helpers
+          end
+        end
+      end
+    end
+  end
+end

data/lib/otori/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Otori
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: otori
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Wout
@@ -29,6 +29,7 @@ files:
 - lib/otori/error.rb
 - lib/otori/form.rb
 - lib/otori/hanami.rb
+- lib/otori/rails.rb
 - lib/otori/signals.rb
 - lib/otori/validator.rb
 - lib/otori/version.rb
@@ -54,7 +55,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.11
+rubygems_version: 4.0.19
 specification_version: 4
 summary: Invisible honeypot spam protection for Rack apps, with a Hanami adapter.
 test_files: []