spamtrap 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c25ad9a77e76067aa77db7ac9f97aad1efde11b3f44a1ea6547a26da434bedd
-  data.tar.gz: 29211ceda85283fb468690b305e942246b9a00afb50e10450ca5e9b4a2839d7f
+  metadata.gz: 619741f1ea048808a9235e1bc02a814c2d6606aed599e188c3ea99d464e2fc85
+  data.tar.gz: e309645da54a5ac5c898b83f8e90b5132361001724469ceabe18bf7f3195fbac
 SHA512:
-  metadata.gz: ed39e2e15276baee291686c81c295bb18b180bc2d58240d48ef019cb1db36bcd90a05b67aa4e68c069d69b934a7e1533a1f16b22e8aec063310a1755cbacea64
-  data.tar.gz: 127e9108db3e7b72c0ea22f1ca586152f94a6cd6c2ba0645aa5b25dbb4c7ad1cb5249c2b7dd2587339297cbeddb0452fa549b84b143c1549f8ea8b431be248aa
+  metadata.gz: 9e8328c22c89ee565ef34c2cff0e2ecad4aae2b9e71a9627bb6162e57e1013577fa53f65a56a217928e8d0503017b4c2508cec435ecf0c911eb257da53087f59
+  data.tar.gz: 49fa2e0f20b2489eb082c9bd4cd3fe1a09f4d4ddd03022676e12a91fc7779a0bab36e1a628205a0a1f29904da8292a984ef11a317bda486eed0c74f1a5d42909

data/lib/spamtrap/controller.rb

@@ -7,13 +7,19 @@ module Spamtrap::Controller
 
   module ActsAsMethods
     def spamtrap(honeypot = 'spamtrap', options = {}, &block)
-      nonce_enabled  = options.delete(:nonce)
-      nonce_timeout  = options.delete(:nonce_timeout) || Spamtrap.nonce_timeout
-      mutate_enabled = options.delete(:mutate)
+      # Capture explicit per-call values; use sentinel so globals are read
+      # at request time rather than at class definition time.
+      nonce_opt   = options.key?(:nonce)         ? options.delete(:nonce)         : :global
+      timeout_opt = options.key?(:nonce_timeout) ? options.delete(:nonce_timeout) : :global
+      mutate_opt  = options.key?(:mutate)        ? options.delete(:mutate)        : :global
 
       before_action(options) do |controller|
         controller.instance_eval(&block) if block_given?
         controller.instance_eval do
+          nonce_enabled  = nonce_opt   == :global ? Spamtrap.nonce         : nonce_opt
+          nonce_timeout  = timeout_opt == :global ? Spamtrap.nonce_timeout : timeout_opt
+          mutate_enabled = mutate_opt  == :global ? Spamtrap.mutate        : mutate_opt
+
           spamtrap_remap_params if mutate_enabled
 
           if params[honeypot].present?

data/lib/spamtrap/helper.rb

@@ -38,8 +38,8 @@ class ActionView::Helpers::FormBuilder
   prepend Spamtrap::FormBuilderMutation
 
   def spamtrap(parameter = 'spamtrap', options = {})
-    mutate = options.delete(:mutate)
-    nonce  = options.delete(:nonce)
+    mutate = options.key?(:mutate) ? options.delete(:mutate) : Spamtrap.mutate
+    nonce  = options.key?(:nonce)  ? options.delete(:nonce)  : Spamtrap.nonce
     options.reverse_merge!(class: 'spamtrap')
 
     if mutate

data/lib/spamtrap/version.rb

@@ -1,5 +1,5 @@
 module Spamtrap
 
-  VERSION = '0.3.0'
+  VERSION = '0.3.1'
 
 end

data/lib/spamtrap.rb

@@ -2,11 +2,19 @@ require 'openssl'
 
 module Spamtrap
   class << self
-    attr_writer :nonce_timeout
+    attr_writer :nonce, :nonce_timeout, :mutate
+
+    def nonce
+      @nonce || false
+    end
 
     def nonce_timeout
       @nonce_timeout || 1800
     end
+
+    def mutate
+      @mutate || false
+    end
   end
 
   require 'spamtrap/crypto'

data/test/controller_test.rb

@@ -242,3 +242,106 @@ class NestedMutationControllerTest < ActionController::TestCase
     assert_equal 'body;city,street', response.body
   end
 end
+
+# Controller that relies entirely on global defaults (no per-call options).
+class GlobalDefaultsController < ActionController::Base
+  spamtrap :trap_field, only: :create
+
+  def create
+    render plain: params[:comment].to_unsafe_h.keys.sort.join(',')
+  end
+end
+
+# Controller that explicitly overrides global defaults with false.
+class GlobalOverrideController < ActionController::Base
+  spamtrap :trap_field, nonce: false, mutate: false, only: :create
+
+  def create
+    render plain: params[:comment].to_unsafe_h.keys.sort.join(',')
+  end
+end
+
+class GlobalDefaultsControllerTest < ActionController::TestCase
+  include MutationTestHelper
+  include NonceTestHelper
+  tests GlobalDefaultsController
+
+  setup do
+    Spamtrap.nonce  = true
+    Spamtrap.mutate = true
+  end
+
+  teardown do
+    Spamtrap.nonce  = false
+    Spamtrap.mutate = false
+  end
+
+  def test_global_nonce_default_rejects_missing_nonce
+    post :create, params: { trap_field: '', comment: { body: 'Hello' } }
+    assert_response :ok
+    assert_empty response.body
+  end
+
+  def test_global_nonce_default_accepts_valid_nonce
+    timestamp = Time.now.to_i
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp),
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { spamtrap_encrypt_field('body', MUTATION_SALT) => 'Hello' }
+    }
+    assert_response :ok
+    assert_equal 'body', response.body
+  end
+
+  def test_global_mutate_default_remaps_encrypted_fields
+    body_token = spamtrap_encrypt_field('body', MUTATION_SALT)
+    timestamp  = Time.now.to_i
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp),
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { body_token => 'Hello' }
+    }
+    assert_response :ok
+    assert_equal 'body', response.body
+  end
+end
+
+class GlobalOverrideControllerTest < ActionController::TestCase
+  include MutationTestHelper
+  tests GlobalOverrideController
+
+  setup do
+    Spamtrap.nonce  = true
+    Spamtrap.mutate = true
+  end
+
+  teardown do
+    Spamtrap.nonce  = false
+    Spamtrap.mutate = false
+  end
+
+  def test_per_call_false_overrides_global_nonce
+    # No nonce params — would fail if global nonce: true were in effect
+    post :create, params: {
+      trap_field: '',
+      comment: { body: 'Hello' }
+    }
+    assert_response :ok
+    assert_equal 'body', response.body
+  end
+
+  def test_per_call_false_overrides_global_mutate
+    # Plain field name — would be remapped if global mutate: true were in effect
+    post :create, params: {
+      trap_field: '',
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { body: 'Hello' }
+    }
+    assert_response :ok
+    assert_equal 'body', response.body
+  end
+end

data/test/test_helper.rb

@@ -18,7 +18,9 @@ Rails.application.routes.draw do
   post 'nonce/create',         to: 'nonce#create'
   post 'nonce_timeout/create', to: 'nonce_timeout#create'
   post 'mutation/create',      to: 'mutation#create'
-  post 'nested_mutation/create', to: 'nested_mutation#create'
+  post 'nested_mutation/create',  to: 'nested_mutation#create'
+  post 'global_defaults/create',  to: 'global_defaults#create'
+  post 'global_override/create',  to: 'global_override#create'
 end
 
 class ActionController::TestCase

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spamtrap
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Cedric Howe