otori 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dad6a295086cd2eb7abd60f81e264cde80726e6802deec8e185b3d6ddd2bd082
-  data.tar.gz: b1fe5bab67f24f249b9b45055fa0a632774b99fa93fe0c156235014c9bdf1416
+  metadata.gz: be91dcf0d80421c3347a3d75e9e7aade7a7479f8e7b100c6d628f394016c2d37
+  data.tar.gz: d8bd1c71cb521c22f5f9797612cd83105bef897584d1a92d3004acaad7625b73
 SHA512:
-  metadata.gz: a275bbc1f3a7ce4a3f8ae0b6a09b0835aeeca30713254819f747e3e3b06f0c2e8a875a6ca604a8df396ada100ce9518238e8575ec1a06a3bb06e2bec5abe8b5d
-  data.tar.gz: 7fee9a413435e3efcf65f5196fdffe168c664935c8e1390f06545cb9f650571e47e031f04f3f9f2649f01a0b62a67229a9e7071199bdc2903c3dfe1543e625f1
+  metadata.gz: 7dbcb90604352965d8f951c2caf025978deafb6e8b23772cafb953a0fba20a2f3a292567ffa48441a0fb82a9794a4c5abb3d82297cfc824effa11bbc8c65bf25
+  data.tar.gz: 2c0df32a81ca7fdce8234e91d52b10379e8931b597732f54de8393c0460409ecd50a5bbe01551a876dd12711fd4ee6db63a12197128db0ad53fb59a157ec18c6

data/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-12
+
+### Changed
+
+- `signals_field` now accepts an `id:` attribute. When omitted, a unique id
+  of the form `otori-signals-<hex>` is generated per call so multiple
+  signals fields can safely coexist on the same page.
+
+### Fixed
+
+- `signals_field` no longer relies on
+  `document.currentScript.previousElementSibling` to locate its hidden input.
+  The input now carries a unique `id` and the tracking script looks it up via
+  `document.getElementById`. The previous approach broke when any DOM mutation
+  (Turbo cache restoration, injected elements, browser extensions) landed
+  between the input and the script, which could cause the signals JSON to be
+  written into a neighbouring field (such as a honeypot) and trigger false
+  positives. Callers can supply their own `id:` to override the generated
+  value, and the script now bails out silently when the input or its form
+  cannot be resolved.
+
 ## [0.2.0] - 2026-09-17
 
 ### Added

data/lib/otori/form.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "cgi"
+require "securerandom"
 
 require_relative "validator"
 
@@ -10,20 +11,6 @@ module Otori
 
     HIDDEN_STYLE = "position:absolute;left:-9999px;width:1px;height:1px;pointer-events:none;"
 
-    SIGNALS_SCRIPT = <<~JS
-      (() => {
-        const s = { m: false, t: false, s: false, k: false, f: false };
-        const input = document.currentScript.previousElementSibling;
-        const form = input.form;
-        form.addEventListener('mousemove', () => s.m = true, { once: true });
-        form.addEventListener('touchstart', () => s.t = true, { once: true });
-        form.addEventListener('keydown', () => s.k = true, { once: true });
-        form.addEventListener('focusin', () => s.f = true, { once: true });
-        window.addEventListener('scroll', () => s.s = true, { once: true });
-        form.addEventListener('submit', () => input.value = JSON.stringify(s));
-      })();
-    JS
-
     def field(name, session:, **attrs)
       raise MissingSession unless session_like?(session)
 
@@ -42,16 +29,41 @@ module Otori
     end
 
     def signals_field(**attrs)
+      stringified = stringify_keys(attrs)
+      id = stringified["id"] || generate_signals_id
+
       input = tag(:input, {
-        name: Otori.config.signals_input_name,
-        type: "hidden"
-      }.merge(stringify_keys(attrs)))
+        "id" => id,
+        "name" => Otori.config.signals_input_name,
+        "type" => "hidden"
+      }.merge(stringified))
 
-      "#{input}<script>#{SIGNALS_SCRIPT}</script>"
+      "#{input}<script>#{signals_script(id)}</script>"
     end
 
     private
 
+    def generate_signals_id
+      "otori-signals-#{SecureRandom.hex(6)}"
+    end
+
+    def signals_script(id)
+      <<~JS
+        (() => {
+          const input = document.getElementById(#{id.to_json});
+          if (!input || !input.form) return;
+          const form = input.form;
+          const s = { m: false, t: false, s: false, k: false, f: false };
+          form.addEventListener('mousemove', () => s.m = true, { once: true });
+          form.addEventListener('touchstart', () => s.t = true, { once: true });
+          form.addEventListener('keydown', () => s.k = true, { once: true });
+          form.addEventListener('focusin', () => s.f = true, { once: true });
+          window.addEventListener('scroll', () => s.s = true, { once: true });
+          form.addEventListener('submit', () => input.value = JSON.stringify(s));
+        })();
+      JS
+    end
+
     def session_like?(object)
       object.respond_to?(:[]) && object.respond_to?(:[]=)
     end

data/lib/otori/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Otori
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: otori
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Wout