spamtrap 0.3.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c25ad9a77e76067aa77db7ac9f97aad1efde11b3f44a1ea6547a26da434bedd
-  data.tar.gz: 29211ceda85283fb468690b305e942246b9a00afb50e10450ca5e9b4a2839d7f
+  metadata.gz: f0cec3797da20a8ab16dd95113f15c271acb6764478291372e14fc8d3556e0a3
+  data.tar.gz: 960f481d33667095c861f91665786ab6e5a60c5a162e9f90fea709b99821b91e
 SHA512:
-  metadata.gz: ed39e2e15276baee291686c81c295bb18b180bc2d58240d48ef019cb1db36bcd90a05b67aa4e68c069d69b934a7e1533a1f16b22e8aec063310a1755cbacea64
-  data.tar.gz: 127e9108db3e7b72c0ea22f1ca586152f94a6cd6c2ba0645aa5b25dbb4c7ad1cb5249c2b7dd2587339297cbeddb0452fa549b84b143c1549f8ea8b431be248aa
+  metadata.gz: 846a83081e7139d5c6ba56674d3f5506abebc583c9f2fc62501fa8dc30d230f391f3a61a63a8a231456368a09c8ba20635d8af1176356d7574c97d1c4c0a9f9c
+  data.tar.gz: fab5e0b02f702ee3f71bb2914d766a6a3ba1fedc90232189844497e5c818927b7cd31ff17eeb0fbf3583494b4e3e54c14e00511055df6a604608a5d850e3c0ad

data/lib/spamtrap/controller.rb

@@ -7,20 +7,29 @@ module Spamtrap::Controller
 
   module ActsAsMethods
     def spamtrap(honeypot = 'spamtrap', options = {}, &block)
-      nonce_enabled  = options.delete(:nonce)
-      nonce_timeout  = options.delete(:nonce_timeout) || Spamtrap.nonce_timeout
-      mutate_enabled = options.delete(:mutate)
+      # Capture explicit per-call values; use sentinel so globals are read
+      # at request time rather than at class definition time.
+      nonce_opt    = options.key?(:nonce)         ? options.delete(:nonce)         : :global
+      timeout_opt  = options.key?(:nonce_timeout) ? options.delete(:nonce_timeout) : :global
+      mutate_opt   = options.key?(:mutate)        ? options.delete(:mutate)        : :global
+      on_trap_opt  = options.key?(:on_trap)       ? options.delete(:on_trap)       : :global
 
       before_action(options) do |controller|
         controller.instance_eval(&block) if block_given?
         controller.instance_eval do
+          nonce_enabled  = nonce_opt   == :global ? Spamtrap.nonce         : nonce_opt
+          nonce_timeout  = timeout_opt == :global ? Spamtrap.nonce_timeout : timeout_opt
+          mutate_enabled = mutate_opt  == :global ? Spamtrap.mutate        : mutate_opt
+
           spamtrap_remap_params if mutate_enabled
 
           if params[honeypot].present?
             Rails.logger.warn "Spamtrap triggered by #{request.remote_ip}."
+            spamtrap_invoke_on_trap(:honeypot, on_trap_opt)
             head 200
           elsif nonce_enabled && !spamtrap_valid_nonce?(nonce_timeout)
             Rails.logger.warn "Spamtrap nonce invalid from #{request.remote_ip}."
+            spamtrap_invoke_on_trap(:nonce, on_trap_opt)
             head 200
           end
         end
@@ -63,7 +72,15 @@ module Spamtrap::Controller
     end
   end
 
-  private :spamtrap_valid_nonce?, :spamtrap_remap_params, :spamtrap_remap_hash
+  def spamtrap_invoke_on_trap(reason, on_trap_opt)
+    callback = on_trap_opt == :global ? Spamtrap.on_trap : on_trap_opt
+    return unless callback.respond_to?(:call)
+    callback.call(reason: reason, request: request)
+  rescue StandardError => e
+    Rails.logger.error "Spamtrap on_trap callback raised: #{e.class}: #{e.message}"
+  end
+
+  private :spamtrap_valid_nonce?, :spamtrap_remap_params, :spamtrap_remap_hash, :spamtrap_invoke_on_trap
 
 end
 

data/lib/spamtrap/helper.rb

@@ -38,8 +38,8 @@ class ActionView::Helpers::FormBuilder
   prepend Spamtrap::FormBuilderMutation
 
   def spamtrap(parameter = 'spamtrap', options = {})
-    mutate = options.delete(:mutate)
-    nonce  = options.delete(:nonce)
+    mutate = options.key?(:mutate) ? options.delete(:mutate) : Spamtrap.mutate
+    nonce  = options.key?(:nonce)  ? options.delete(:nonce)  : Spamtrap.nonce
     options.reverse_merge!(class: 'spamtrap')
 
     if mutate

data/lib/spamtrap/version.rb

@@ -1,5 +1,5 @@
 module Spamtrap
 
-  VERSION = '0.3.0'
+  VERSION = '0.3.2'
 
 end

data/lib/spamtrap.rb

@@ -2,11 +2,20 @@ require 'openssl'
 
 module Spamtrap
   class << self
-    attr_writer :nonce_timeout
+    attr_accessor :on_trap
+    attr_writer   :nonce, :nonce_timeout, :mutate
+
+    def nonce
+      @nonce || false
+    end
 
     def nonce_timeout
       @nonce_timeout || 1800
     end
+
+    def mutate
+      @mutate || false
+    end
   end
 
   require 'spamtrap/crypto'

data/test/controller_test.rb

@@ -242,3 +242,232 @@ class NestedMutationControllerTest < ActionController::TestCase
     assert_equal 'body;city,street', response.body
   end
 end
+
+# Controller that relies entirely on global defaults (no per-call options).
+class GlobalDefaultsController < ActionController::Base
+  spamtrap :trap_field, only: :create
+
+  def create
+    render plain: params[:comment].to_unsafe_h.keys.sort.join(',')
+  end
+end
+
+# Controller that explicitly overrides global defaults with false.
+class GlobalOverrideController < ActionController::Base
+  spamtrap :trap_field, nonce: false, mutate: false, only: :create
+
+  def create
+    render plain: params[:comment].to_unsafe_h.keys.sort.join(',')
+  end
+end
+
+class GlobalDefaultsControllerTest < ActionController::TestCase
+  include MutationTestHelper
+  include NonceTestHelper
+  tests GlobalDefaultsController
+
+  setup do
+    Spamtrap.nonce  = true
+    Spamtrap.mutate = true
+  end
+
+  teardown do
+    Spamtrap.nonce  = false
+    Spamtrap.mutate = false
+  end
+
+  def test_global_nonce_default_rejects_missing_nonce
+    post :create, params: { trap_field: '', comment: { body: 'Hello' } }
+    assert_response :ok
+    assert_empty response.body
+  end
+
+  def test_global_nonce_default_accepts_valid_nonce
+    timestamp = Time.now.to_i
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp),
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { spamtrap_encrypt_field('body', MUTATION_SALT) => 'Hello' }
+    }
+    assert_response :ok
+    assert_equal 'body', response.body
+  end
+
+  def test_global_mutate_default_remaps_encrypted_fields
+    body_token = spamtrap_encrypt_field('body', MUTATION_SALT)
+    timestamp  = Time.now.to_i
+    post :create, params: {
+      trap_field: '',
+      spamtrap_timestamp: timestamp,
+      spamtrap_nonce: generate_nonce(timestamp),
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { body_token => 'Hello' }
+    }
+    assert_response :ok
+    assert_equal 'body', response.body
+  end
+end
+
+class GlobalOverrideControllerTest < ActionController::TestCase
+  include MutationTestHelper
+  tests GlobalOverrideController
+
+  setup do
+    Spamtrap.nonce  = true
+    Spamtrap.mutate = true
+  end
+
+  teardown do
+    Spamtrap.nonce  = false
+    Spamtrap.mutate = false
+  end
+
+  def test_per_call_false_overrides_global_nonce
+    # No nonce params — would fail if global nonce: true were in effect
+    post :create, params: {
+      trap_field: '',
+      comment: { body: 'Hello' }
+    }
+    assert_response :ok
+    assert_equal 'body', response.body
+  end
+
+  def test_per_call_false_overrides_global_mutate
+    # Plain field name — would be remapped if global mutate: true were in effect
+    post :create, params: {
+      trap_field: '',
+      spamtrap_mutation_salt: MUTATION_SALT_HEX,
+      comment: { body: 'Hello' }
+    }
+    assert_response :ok
+    assert_equal 'body', response.body
+  end
+end
+
+# Controllers for on_trap callback tests.
+class OnTrapGlobalCallbackController < ActionController::Base
+  spamtrap :trap_field, only: :create
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class OnTrapGlobalNonceCallbackController < ActionController::Base
+  spamtrap :trap_field, nonce: true, only: :create
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class OnTrapPerDeclarationController < ActionController::Base
+  spamtrap :trap_field, only: :create,
+    on_trap: ->(reason:, request:) { Thread.current[:per_decl_calls] << { reason: reason, ip: request.remote_ip } }
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class OnTrapCallbackTest < ActionController::TestCase
+  tests OnTrapGlobalCallbackController
+
+  setup do
+    @calls = []
+    Spamtrap.on_trap = ->(reason:, request:) { @calls << { reason: reason, ip: request.remote_ip } }
+  end
+
+  teardown do
+    Spamtrap.on_trap = nil
+  end
+
+  def test_global_callback_invoked_on_honeypot_trap
+    post :create, params: { trap_field: 'spam' }
+    assert_response :ok
+    assert_empty response.body
+    assert_equal 1, @calls.size
+    assert_equal :honeypot, @calls.first[:reason]
+  end
+
+  def test_global_callback_not_invoked_on_legitimate_request
+    post :create, params: { trap_field: '' }
+    assert_response :ok
+    assert_equal 'success', response.body
+    assert_empty @calls
+  end
+
+  def test_no_callback_when_on_trap_is_nil
+    Spamtrap.on_trap = nil
+    post :create, params: { trap_field: 'spam' }
+    assert_response :ok
+    assert_empty response.body
+    # no error raised — test simply passes
+  end
+end
+
+class OnTrapNonceCallbackTest < ActionController::TestCase
+  include NonceTestHelper
+  tests OnTrapGlobalNonceCallbackController
+
+  setup do
+    @calls = []
+    Spamtrap.on_trap = ->(reason:, request:) { @calls << { reason: reason, ip: request.remote_ip } }
+  end
+
+  teardown do
+    Spamtrap.on_trap = nil
+  end
+
+  def test_global_callback_invoked_on_nonce_trap
+    post :create, params: { trap_field: '' }
+    assert_response :ok
+    assert_empty response.body
+    assert_equal 1, @calls.size
+    assert_equal :nonce, @calls.first[:reason]
+  end
+end
+
+class OnTrapPerDeclarationCallbackTest < ActionController::TestCase
+  tests OnTrapPerDeclarationController
+
+  setup do
+    Thread.current[:per_decl_calls] = []
+    @global_calls = []
+    Spamtrap.on_trap = ->(reason:, request:) { @global_calls << reason }
+  end
+
+  teardown do
+    Spamtrap.on_trap = nil
+    Thread.current[:per_decl_calls] = nil
+  end
+
+  def test_per_declaration_callback_takes_precedence_over_global
+    post :create, params: { trap_field: 'spam' }
+    assert_response :ok
+    assert_empty response.body
+    assert_equal 1, Thread.current[:per_decl_calls].size
+    assert_equal :honeypot, Thread.current[:per_decl_calls].first[:reason]
+    assert_empty @global_calls
+  end
+end
+
+class OnTrapCallbackErrorResilienceTest < ActionController::TestCase
+  tests OnTrapGlobalCallbackController
+
+  setup do
+    Spamtrap.on_trap = ->(**) { raise 'callback exploded' }
+  end
+
+  teardown do
+    Spamtrap.on_trap = nil
+  end
+
+  def test_broken_callback_does_not_prevent_head_200
+    post :create, params: { trap_field: 'spam' }
+    assert_response :ok
+    assert_empty response.body
+  end
+end

data/test/test_helper.rb

@@ -18,7 +18,12 @@ Rails.application.routes.draw do
   post 'nonce/create',         to: 'nonce#create'
   post 'nonce_timeout/create', to: 'nonce_timeout#create'
   post 'mutation/create',      to: 'mutation#create'
-  post 'nested_mutation/create', to: 'nested_mutation#create'
+  post 'nested_mutation/create',  to: 'nested_mutation#create'
+  post 'global_defaults/create',  to: 'global_defaults#create'
+  post 'global_override/create',  to: 'global_override#create'
+  post 'on_trap_global_callback/create',       to: 'on_trap_global_callback#create'
+  post 'on_trap_global_nonce_callback/create', to: 'on_trap_global_nonce_callback#create'
+  post 'on_trap_per_declaration/create',       to: 'on_trap_per_declaration#create'
 end
 
 class ActionController::TestCase

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spamtrap
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Cedric Howe