otori 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9139cc5240c7900afc1038f7634429d8cac065d9e22c3645e4891dd9f1fd9103
-  data.tar.gz: d0adef9a1384d5123b7e304879fb9691ebc35e77e238b39a6348419ac8bde074
+  metadata.gz: 554c128771ba6ee67560679dc82411c949a7950188d9d89c50419d4f2135b288
+  data.tar.gz: 562127711e5aa8d21bdde1d65cea1209e26f228d50c9b16a75530dcea7248a78
 SHA512:
-  metadata.gz: e03586c88e10498d34371303c0d87b09cb8bf643d99e8e30f5b0b19a6ab2851476f6290c547b74d6cfd7c819b281269ccf76d706bc5e42dd03131fa49d4965cf
-  data.tar.gz: 44b8afe56864c015efc19ee2a00ede9167f53bfe471ec7e74ef5ec5d05414522c2835c173e3c5005248447b2241d15c8b1c20e38ed5d4981d986e6d8456ab823
+  metadata.gz: 79b5ba2de508acc8324892a7ee500a2e5d1252bb82ecda1d7c9f809211f12a35d92a2b7d6c64d638a2003a58215ed252495e5b311be5794b97be0eadfd5d02aa
+  data.tar.gz: 7ec7f1393886c5064bbec6819b1e6637a5a6366b511485c2d6ae66dfe8cceebc1ec92ca15336427cae491aa496ae4f688585223663a58ec3b372433afb911700

data/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- `Otori::Signals#pragmatic_rating` and `Otori.signals_rating(params,
+  pragmatic: true)`. The raw `human_rating` is unchanged and stays honest:
+  desktop users without a touchscreen can trigger at most four of the five
+  signals, capping them at `0.8`. The pragmatic rating treats `0.8` and up
+  as fully human without influencing lower ratings: values at or below `0.4`
+  are returned untouched, and the `0.4` to `0.8` range is stretched linearly
+  to `0.4` to `1.0` (so `0.6` becomes `0.7`). Opt in per call; the default
+  `Otori.signals_rating(params)` keeps returning the raw rating.
+
+## [0.5.0] - 2026-10-13
+
+### Added
+
+- Passing `wait: false` to `Otori.reason` / `Otori.caught?` (and the
+  Rails/Hanami `honeypot` macros) skips the timing check entirely while
+  keeping the filled-field check active. Useful for forms where
+  password-manager autofill or sticky-session returns make even a short
+  timer prone to false positives. `wait: nil` continues to fall back to
+  `config.default_delay`; only an explicit `false` disables timing.
+
 ## [0.4.0] - 2026-10-13
 
 ### Added

data/README.md

@@ -18,7 +18,8 @@ techniques into one gem:
 
 1. **Invisible fields**. Bots fill out every field, including ones hidden with CSS.
 2. **Timing checks**. Bots submit forms instantly, humans need more time.
-3. **Input signals**. Bots don't tend to trigger mouse, touch, scroll, keyboard, or focus events.
+3. **Input signals**. Bots don't tend to trigger mouse, touch, scroll,
+   keyboard, or focus events.
 
 When either of the first two checks fail, the submission is quietly rejected.
 The bot thinks it succeeded and moves on. The third one can be used to reject
@@ -173,6 +174,14 @@ honeypot "note" do |_req, _res|
 end
 ```
 
+Pass `wait: false` to skip the timing check entirely while keeping the
+filled-field check active. Useful on login or password-reset forms where
+password-manager autofill routinely beats any reasonable timer:
+
+```ruby
+honeypot "user[website]", wait: false
+```
+
 To act on the input-signals rating, evaluate it inside `handle`:
 
 ```ruby
@@ -243,6 +252,14 @@ class SignUpsController < ApplicationController
 end
 ```
 
+Pass `wait: false` to skip the timing check entirely while keeping the
+filled-field check active. Useful on forms where password-manager autofill
+beats any reasonable timer (login, password reset):
+
+```ruby
+honeypot :username, wait: false, only: :create
+```
+
 When the honeypot is tripped, the request halts with `:no_content` by default.
 To customize the response, pass a block. The block optionally receives the
 catch reason (`:filled` or `:too_fast`), handy for logging or branching:
@@ -339,6 +356,22 @@ signals.focus?
 > password manager submissions, which often only trigger focus plus mouse or
 > touch.
 
+### Pragmatic rating
+
+Desktop users without a touchscreen can trigger at most four of the five
+signals, capping their raw rating at `0.8`. The raw rating always stays honest,
+but if you want such submissions to count as fully human, ask for the pragmatic
+rating:
+
+```ruby
+Otori.signals_rating(params, pragmatic: true)
+signals.pragmatic_rating
+```
+
+Ratings at or below `0.4` are returned unchanged, the `0.4` to `0.8` range is
+stretched linearly to `0.4` to `1.0`, and anything `0.8` or above counts as
+fully human.
+
 ## Security considerations
 
 This gem provides basic bot protection, but it should not be your only line

data/lib/otori/signals.rb

@@ -16,7 +16,7 @@ module Otori
       raw = JSON.parse(json.to_s)
       raise JSON::ParserError, "expected an object" unless raw.is_a?(Hash)
 
-      new(KEYS.transform_values { raw[_1] == true })
+      new(KEYS.transform_values { raw[it] == true })
     rescue JSON::ParserError
       new
     end
@@ -25,8 +25,17 @@ module Otori
       from_json(json).human_rating
     end
 
+    def self.pragmatic_rating(json)
+      from_json(json).pragmatic_rating
+    end
+
+    # Touchless devices can trigger at most four signals, capping them at 0.8,
+    # so this stretches 0.4-0.8 to 0.4-1.0 to let them rate as fully human.
+    PRAGMATIC_ANCHOR = 0.4
+    PRAGMATIC_CLEAN = 0.8
+
     def initialize(flags = {})
-      @flags = KEYS.keys.to_h { [_1, flags.fetch(_1, false) == true] }
+      @flags = KEYS.keys.to_h { [it, flags.fetch(it, false) == true] }
     end
 
     KEYS.each_key do |key|
@@ -37,6 +46,15 @@ module Otori
       @flags.values.count(true) / KEYS.size.to_f
     end
 
+    def pragmatic_rating
+      raw = human_rating
+      return raw if raw <= PRAGMATIC_ANCHOR
+      return 1.0 if raw >= PRAGMATIC_CLEAN
+
+      span = (1.0 - PRAGMATIC_ANCHOR) / (PRAGMATIC_CLEAN - PRAGMATIC_ANCHOR)
+      (PRAGMATIC_ANCHOR + (raw - PRAGMATIC_ANCHOR) * span).round(2)
+    end
+
     def to_h = @flags.dup
   end
 end

data/lib/otori/validator.rb

@@ -10,6 +10,7 @@ module Otori
 
     def elapsed?(timestamp_ms, wait_seconds, now: monotonic_ms)
       return true if Otori.config.disable_delay
+      return true if wait_seconds == false
       return false if timestamp_ms.nil?
 
       (now - timestamp_ms.to_i) >= (wait_seconds.to_f * 1000)

data/lib/otori/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Otori
-  VERSION = "0.4.0"
+  VERSION = "0.6.0"
 end

data/lib/otori.rb

@@ -35,7 +35,7 @@ module Otori
     end
 
     def reason(name, params:, session:, wait: nil)
-      wait ||= config.default_delay
+      wait = config.default_delay if wait.nil?
       session_key = config.session_key(name)
       stored = session_get(session, session_key)
       filled = Validator.filled?(param_value(params, name))
@@ -50,11 +50,15 @@ module Otori
       caught
     end
 
-    def signals_rating(params)
+    def signals_rating(params, pragmatic: false)
       raw = param_value(params, config.signals_input_name)
       return 0.0 if raw.nil? || raw.to_s.empty?
 
-      Signals.human_rating(raw.to_s)
+      if pragmatic
+        Signals.pragmatic_rating(raw.to_s)
+      else
+        Signals.human_rating(raw.to_s)
+      end
     end
 
     private

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: otori
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Wout