reputable 0.1.15 → 0.1.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 46a14f8686b7e3ad1aa8a8c2e22f5c14f13a3d6667ad9bb4ca1e088024989f7d
-  data.tar.gz: 6b6e95c46a329214b02279c23d02b55067f8a86f74cc6f17159b35dd43d08ef6
+  metadata.gz: 8767ca87c7fdd5abc6584e738599020cbd6977bc6193371caeef1425eedb8dfd
+  data.tar.gz: 5196f00349ec3b380bec72db3b98c5f09d08965d297e7f43a8c639b9d1eed3dd
 SHA512:
-  metadata.gz: 542429b9c9716d69889873b9212b4500669a074c24595f8f933f64568161ca6a562de7b6aa307ede64252b35599d5e768279abee078724d358ab2a2bc14f6f90
-  data.tar.gz: e3978a1b8e21332bd1a7e1ef26a719398c478762f74a5959bdc8c85c720de7fe97a03b4c525df7c892273329f8c1d02c1fe38163fcdee21d92479dfc81b735a2
+  metadata.gz: 36285df97965903af8e913d3f0937969ae4e48399f0468fd2e00b22d3b0e7c6d50d51682d9ec82a31483729ca7f0d69d4d0ec47115b12dce62ff01948d18b3ec
+  data.tar.gz: 6aea15486988795b5ce444581be796e33d15906c871f5cc28208d876b0604053603f455f8d16536b4879773991905f85882f56b4fed47d85b71b1ea9abb34a42

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    reputable (0.1.15)
+    reputable (0.1.17)
       connection_pool (~> 2.2)
       redis (>= 4.0, < 6.0)
 

data/README.md

@@ -275,6 +275,10 @@ config.middleware.use Reputable::Middleware,
   # Falls back to ENV REPUTABLE_TRACK_REQUEST if not set
   track_request: true,
 
+  # Ignore XHR requests (default: false)
+  # Useful for suppressing tracking of background widgets or polling
+  ignore_xhr: true,
+
   # Expose reputation flags in request env for views/controllers (default: true)
   # Sets request.env['reputable.ignore_analytics'] for any untrusted_* status
   expose_reputation: true
@@ -301,6 +305,33 @@ Notes:
 - Use `blocked_page_path` only for local blocked pages (or to build a custom `failure_url`).
 - Override `challenge_redirect_status` (default `302`) or `verification_force_challenge` if needed.
 
+### Server/JS Request Reconciliation
+
+When using both server-side tracking (Rack middleware) and client-side JavaScript tracking, requests can be double-counted. The reconciliation system prevents this by correlating requests using a unique `request_id`.
+
+**Automatic Request ID**: The middleware automatically generates a UUID for each request and stores it in `env['reputable.request_id']`. This ID is included when pushing to the Redis buffer.
+
+**Exposing to JavaScript**: To enable reconciliation, expose the request_id in your views:
+
+```erb
+<%# In your layout (app/views/layouts/application.html.erb) %>
+<meta name="reputable-request-id" content="<%= request.env['reputable.request_id'] %>">
+
+<%# Or via JavaScript variable %>
+<script>
+  window.reputableConfig = {
+    requestId: '<%= request.env['reputable.request_id'] %>'
+  };
+</script>
+```
+
+The JavaScript snippet will automatically read the request_id from:
+1. `data-reputable-request-id` attribute on the script tag
+2. `window.reputableConfig.requestId`
+3. `<meta name="reputable-request-id">` tag
+
+**Bot Detection Signal**: If the middleware tracks a request but JavaScript never fires (after a 10-second grace period), the request is flagged with `risk:no_js`. This is a strong bot signal—bots and crawlers typically don't render JavaScript.
+
 ### Default Skipped Paths
 
 The middleware automatically skips:

data/lib/reputable/middleware.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "blocked_page"
+require "securerandom"
 
 module Reputable
   # Rack middleware for automatic request tracking
@@ -58,9 +59,14 @@ module Reputable
       @verified_session_keys = Array(options.fetch(:verified_session_keys, [:reputable_verified_at, :reputable_verified]))
       @blocked_page_options = options.fetch(:blocked_page, {})
       @blocked_page_path = options[:blocked_page_path]
+      @ignore_xhr = options.fetch(:ignore_xhr, false)
     end
 
     def call(env)
+      # Generate a unique request ID for reconciliation with JS tracking
+      # This ID is exposed to views so it can be included in the JS snippet
+      env['reputable.request_id'] = SecureRandom.uuid
+
       # Check for verification return parameters and verify signature if present
       handle_verification_return(env)
 
@@ -351,6 +357,7 @@ module Reputable
 
     def skip_request?(env)
       return true if @skip_if&.call(env)
+      return true if @ignore_xhr && xhr_request?(env)
 
       path = env["PATH_INFO"] || "/"
 
@@ -390,7 +397,8 @@ module Reputable
         method: request.request_method,
         user_agent: env["HTTP_USER_AGENT"],
         referer: env["HTTP_REFERER"],
-        tags: build_tags(env)
+        tags: build_tags(env),
+        request_id: env["reputable.request_id"]
       }.compact
     rescue StandardError => e
       Reputable.logger&.debug("Reputable build_params: #{e.class} - #{e.message}")
@@ -516,5 +524,9 @@ module Reputable
     rescue StandardError
       nil
     end
+
+    def xhr_request?(env)
+      env["HTTP_X_REQUESTED_WITH"].to_s.downcase == "xmlhttprequest"
+    end
   end
 end

data/lib/reputable/tracker.rb

@@ -24,6 +24,7 @@ module Reputable
       # @option options [String] :country Country code (ISO 3166-1 alpha-2)
       # @option options [Array<String>] :tags Custom classification tags
       # @option options [Hash] :metadata Additional metadata
+      # @option options [String] :request_id Unique request ID for reconciliation with JS tracking
       # @return [Boolean] true if successfully pushed to buffer, false otherwise
       #
       # @example Basic usage
@@ -32,7 +33,7 @@ module Reputable
       #     path: "/products/123"
       #   )
       #
-      # @example Full usage
+      # @example Full usage with request_id for JS reconciliation
       #   Reputable::Tracker.track_request(
       #     ip: request.ip,
       #     path: request.path,
@@ -40,6 +41,7 @@ module Reputable
       #     method: request.request_method,
       #     user_agent: request.user_agent,
       #     referer: request.referer,
+      #     request_id: env['reputable.request_id'],
       #     tags: ["view:page:product", "trust:channel:organic"]
       #   )
       def track_request(ip:, path:, **options)
@@ -80,7 +82,8 @@ module Reputable
           referer: options[:referer],
           country: options[:country],
           tags: options[:tags] || [],
-          metadata: options[:metadata]
+          metadata: options[:metadata],
+          request_id: options[:request_id]
         }.compact
       end
 

data/lib/reputable/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Reputable
-  VERSION = "0.1.15"
+  VERSION = "0.1.17"
 end

data/reputable.gemspec

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require_relative "lib/reputable/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "reputable"
+  spec.version = Reputable::VERSION
+  spec.authors = ["Reputable"]
+  spec.email = ["support@reputable.click"]
+
+  spec.summary = "Ruby client for Reputable - bot detection and reputation scoring"
+  spec.description = "Track requests and manage IP reputation through Redis/Dragonfly integration with Reputable"
+  spec.homepage = "https://github.com/reputable-click/reputable-rb"
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 2.7.0"
+
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      (f == __FILE__) || f.match(%r{\A(?:(?:bin|test|spec|features)/|\.(?:git|travis|circleci)|appveyor)}) || f.end_with?(".gem")
+    end
+  end
+  spec.bindir = "exe"
+  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency "redis", ">= 4.0", "< 6.0"
+  spec.add_dependency "connection_pool", "~> 2.2"
+
+  spec.add_development_dependency "bundler", "~> 2.0"
+  spec.add_development_dependency "rake", "~> 13.0"
+  spec.add_development_dependency "rspec", "~> 3.12"
+  spec.add_development_dependency "rack", "~> 2.0"
+  spec.add_development_dependency "rubocop", "~> 1.0"
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: reputable
 version: !ruby/object:Gem::Version
-  version: 0.1.15
+  version: 0.1.17
 platform: ruby
 authors:
 - Reputable
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-01-28 00:00:00.000000000 Z
+date: 2026-01-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redis
@@ -137,6 +137,7 @@ files:
 - lib/reputable/reputation.rb
 - lib/reputable/tracker.rb
 - lib/reputable/version.rb
+- reputable.gemspec
 homepage: https://github.com/reputable-click/reputable-rb
 licenses:
 - MIT