otori 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9139cc5240c7900afc1038f7634429d8cac065d9e22c3645e4891dd9f1fd9103
-  data.tar.gz: d0adef9a1384d5123b7e304879fb9691ebc35e77e238b39a6348419ac8bde074
+  metadata.gz: 7d06214bc12e9ac02bb0989a000bbf68987a12cc15d0a3c178a1fffcfd92503f
+  data.tar.gz: 474f1fb57b296c594d22fb4c00126658c9209fe0f8c10a323b0f34c014893e26
 SHA512:
-  metadata.gz: e03586c88e10498d34371303c0d87b09cb8bf643d99e8e30f5b0b19a6ab2851476f6290c547b74d6cfd7c819b281269ccf76d706bc5e42dd03131fa49d4965cf
-  data.tar.gz: 44b8afe56864c015efc19ee2a00ede9167f53bfe471ec7e74ef5ec5d05414522c2835c173e3c5005248447b2241d15c8b1c20e38ed5d4981d986e6d8456ab823
+  metadata.gz: f58ff908079e04df4436fcf0266e22cc1453c020a295f4e2fe6f0317664efd587ec7e2dbf45c6492035823ec212414a86939aab81d7176fb595bf65fba4d4fcc
+  data.tar.gz: 686f43334060ddc3067be606224c9b07b5a1e1fefc6519faa3e75cc1fc572f4967909d60ea08b32f35c53053408b6dfd79dd71e7c29067387e49c94fb4899e93

data/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-10-13
+
+### Added
+
+- Passing `wait: false` to `Otori.reason` / `Otori.caught?` (and the
+  Rails/Hanami `honeypot` macros) skips the timing check entirely while
+  keeping the filled-field check active. Useful for forms where
+  password-manager autofill or sticky-session returns make even a short
+  timer prone to false positives. `wait: nil` continues to fall back to
+  `config.default_delay`; only an explicit `false` disables timing.
+
 ## [0.4.0] - 2026-10-13
 
 ### Added

data/README.md

@@ -18,7 +18,8 @@ techniques into one gem:
 
 1. **Invisible fields**. Bots fill out every field, including ones hidden with CSS.
 2. **Timing checks**. Bots submit forms instantly, humans need more time.
-3. **Input signals**. Bots don't tend to trigger mouse, touch, scroll, keyboard, or focus events.
+3. **Input signals**. Bots don't tend to trigger mouse, touch, scroll,
+   keyboard, or focus events.
 
 When either of the first two checks fail, the submission is quietly rejected.
 The bot thinks it succeeded and moves on. The third one can be used to reject
@@ -173,6 +174,14 @@ honeypot "note" do |_req, _res|
 end
 ```
 
+Pass `wait: false` to skip the timing check entirely while keeping the
+filled-field check active. Useful on login or password-reset forms where
+password-manager autofill routinely beats any reasonable timer:
+
+```ruby
+honeypot "user[website]", wait: false
+```
+
 To act on the input-signals rating, evaluate it inside `handle`:
 
 ```ruby
@@ -243,6 +252,14 @@ class SignUpsController < ApplicationController
 end
 ```
 
+Pass `wait: false` to skip the timing check entirely while keeping the
+filled-field check active. Useful on forms where password-manager autofill
+beats any reasonable timer (login, password reset):
+
+```ruby
+honeypot :username, wait: false, only: :create
+```
+
 When the honeypot is tripped, the request halts with `:no_content` by default.
 To customize the response, pass a block. The block optionally receives the
 catch reason (`:filled` or `:too_fast`), handy for logging or branching:

data/lib/otori/validator.rb

@@ -10,6 +10,7 @@ module Otori
 
     def elapsed?(timestamp_ms, wait_seconds, now: monotonic_ms)
       return true if Otori.config.disable_delay
+      return true if wait_seconds == false
       return false if timestamp_ms.nil?
 
       (now - timestamp_ms.to_i) >= (wait_seconds.to_f * 1000)

data/lib/otori/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Otori
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/lib/otori.rb

@@ -35,7 +35,7 @@ module Otori
     end
 
     def reason(name, params:, session:, wait: nil)
-      wait ||= config.default_delay
+      wait = config.default_delay if wait.nil?
       session_key = config.session_key(name)
       stored = session_get(session, session_key)
       filled = Validator.filled?(param_value(params, name))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: otori
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Wout