@arnaudw38/nodebb-plugin-spam-be-gone 1.0.5 → 1.0.7

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.0.8] - 2026-02-25
+
+### Fixed
+- Fixed Turnstile login retry reset in themes/login flows where previous click/enter hooks did not reliably trigger the widget reset.
+- Made login retry reset logic target the current Turnstile container dynamically instead of relying on a stale target id.
+- Added a fallback reset trigger when login error alerts are rendered on the login page.
+
+## [1.0.7] - 2026-02-25
+
+### Fixed
+- Login retry Turnstile reset now uses native event listeners only (removed jQuery delegated login listeners).
+- Prevented duplicate retry-reset triggers caused by mixed jQuery + native listeners on some NodeBB themes.
+
+### Changed
+- Simplified login retry detection to click + Enter key flows (removed submit listener).
+
+## [1.0.6] - 2026-02-25
+
+### Fixed
+- Fixed login retry Turnstile reset trigger on NodeBB login flows that do not emit the expected jQuery submit/click events.
+- Prevented missing reset after failed login without page reload by adding capture-phase submit/click/Enter listeners.
+
 ## [1.0.5] - 2026-02-25
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnaudw38/nodebb-plugin-spam-be-gone",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Anti-spam plugin for NodeBB 4.x using Akismet, StopForumSpam API, ProjectHoneyPot, and Cloudflare Turnstile (Turnstile-only fork)",
   "main": "library.js",
   "scripts": {},

package/public/js/scripts.js

@@ -8,6 +8,7 @@ $(function () {
 	var turnstileState = {
 		widgets: {},
 		loginBindingsAttached: false,
+		loginResetTimers: [],
 	};
 
 	function getTurnstileArgs() {
@@ -34,59 +35,121 @@ $(function () {
 		return input && input.value;
 	}
 
+	function getCurrentLoginTurnstileTargetId() {
+		var args = getTurnstileArgs();
+		return args && args.targetId;
+	}
+
 	function resetTurnstileWidget(targetId) {
 		if (typeof turnstile === 'undefined') {
-			return;
+			return false;
+		}
+		targetId = targetId || getCurrentLoginTurnstileTargetId();
+		if (!targetId) {
+			return false;
 		}
 		var widgetId = turnstileState.widgets[targetId];
 		if (widgetId === undefined || widgetId === null) {
-			return;
+			return false;
 		}
 		try {
 			turnstile.reset(widgetId);
+			return true;
 		} catch (err) {
 			// Ignore reset errors when the widget is already destroyed by navigation.
+			return false;
 		}
 	}
 
-	function scheduleLoginTurnstileReset(targetId) {
-		// Turnstile tokens are single-use. On failed login, NodeBB keeps the user on the
-		// same page, so we refresh the widget shortly after submit to allow a retry.
-		[1200, 3000].forEach(function (delay) {
-			window.setTimeout(function () {
-				if (ajaxify.data && ajaxify.data.template && ajaxify.data.template.name && ajaxify.data.template.name !== 'login') {
+	function scheduleLoginTurnstileReset() {
+		// Turnstile tokens are single-use. On failed login, NodeBB often keeps the user on the
+		// same page and may handle submission via AJAX/click handlers. We try multiple delayed resets.
+		turnstileState.loginResetTimers.forEach(function (timerId) {
+			window.clearTimeout(timerId);
+		});
+		turnstileState.loginResetTimers = [];
+
+		[700, 1400, 2600, 4200].forEach(function (delay) {
+			var timerId = window.setTimeout(function () {
+				var onLoginPage = !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
+				if (!onLoginPage) {
 					return;
 				}
-				if (!document.getElementById(targetId)) {
+				var targetId = getCurrentLoginTurnstileTargetId();
+				if (!targetId || !document.getElementById(targetId)) {
 					return;
 				}
-				// Reset unconditionally if we're still on the login page after submit.
-				// Tokens are single-use and may already have been cleared by the form logic
-				// when a login attempt fails, so checking the hidden input is unreliable.
 				resetTurnstileWidget(targetId);
 			}, delay);
+			turnstileState.loginResetTimers.push(timerId);
 		});
 	}
 
-	function bindLoginRetryReset(targetId) {
+	function bindLoginRetryReset() {
 		if (turnstileState.loginBindingsAttached) {
 			return;
 		}
 		turnstileState.loginBindingsAttached = true;
 
-		$(document)
-			.off('submit.spamBeGoneTurnstileLogin')
-			.on('submit.spamBeGoneTurnstileLogin', 'form[action="/login"], form[data-action="login"], #login', function () {
-				scheduleLoginTurnstileReset(targetId);
-			})
-			.off('click.spamBeGoneTurnstileLogin')
-			.on('click.spamBeGoneTurnstileLogin', '[component="login/submit"]', function () {
-				scheduleLoginTurnstileReset(targetId);
-			})
-			.off('input.spamBeGoneTurnstileLogin change.spamBeGoneTurnstileLogin');
+		function loginSubmitTrigger() {
+			scheduleLoginTurnstileReset();
+		}
+
+		// Native capture listeners only (avoid duplicate handlers/race conditions with jQuery delegates).
+		document.addEventListener('click', function (ev) {
+			var btn = ev.target && ev.target.closest ? ev.target.closest('[component="login/submit"], #login [type="submit"], form[action*="/login"] [type="submit"], form[data-action="login"] [type="submit"], button[type="submit"]') : null;
+			if (!btn) {
+				return;
+			}
+			var inLogin = btn.closest && btn.closest('#login, form[action*="/login"], form[data-action="login"], [component="login"]');
+			if (inLogin || (ajaxify.data && ajaxify.data.tpl_url === 'login')) {
+				loginSubmitTrigger();
+			}
+		}, true);
+
+		// Enter key in login fields for themes that trigger login without a click event.
+		document.addEventListener('keydown', function (ev) {
+			if (ev.key !== 'Enter') {
+				return;
+			}
+			var el = ev.target;
+			if (!el || !el.closest) {
+				return;
+			}
+			var inLogin = el.closest('#login, form[action*="/login"], form[data-action="login"], [component="login"]');
+			if (inLogin || (ajaxify.data && ajaxify.data.tpl_url === 'login')) {
+				loginSubmitTrigger();
+			}
+		}, true);
+
+		// Extra safety: reset again when a login error alert appears (covers AJAX flows that do not
+		// reliably trigger the expected submit/click path in some themes).
+		if (window.MutationObserver) {
+			var observer = new MutationObserver(function (mutations) {
+				var onLoginPage = !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
+				if (!onLoginPage) {
+					return;
+				}
+				for (var i = 0; i < mutations.length; i += 1) {
+					for (var j = 0; j < mutations[i].addedNodes.length; j += 1) {
+						var n = mutations[i].addedNodes[j];
+						if (!n || n.nodeType !== 1) {
+							continue;
+						}
+						var hasError = (n.matches && n.matches('.alert-danger, .alert-error, .text-danger, [component="alerts/error"]')) ||
+							(n.querySelector && n.querySelector('.alert-danger, .alert-error, .text-danger, [component="alerts/error"]'));
+						if (hasError) {
+							scheduleLoginTurnstileReset();
+							return;
+						}
+					}
+				}
+			});
+			observer.observe(document.body, { childList: true, subtree: true });
+		}
 	}
 
-	function renderTurnstileIfNeeded(isLoginPage) {
+function renderTurnstileIfNeeded(isLoginPage) {
 		var args = getTurnstileArgs();
 		if (!args || (isLoginPage && !args.addLoginTurnstile)) {
 			return;
@@ -104,7 +167,7 @@ $(function () {
 
 				if (target.dataset.turnstileRendered === '1') {
 					if (isLoginPage) {
-						bindLoginRetryReset(args.targetId);
+						bindLoginRetryReset();
 					}
 					return;
 				}
@@ -134,7 +197,7 @@ $(function () {
 				target.dataset.turnstileRendered = '1';
 				turnstileState.widgets[args.targetId] = widgetId;
 				if (isLoginPage) {
-					bindLoginRetryReset(args.targetId);
+					bindLoginRetryReset();
 				}
 			})
 			.catch(function () {