@arnaudw38/nodebb-plugin-spam-be-gone 1.0.6 → 1.0.7

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.0.8] - 2026-02-25
+
+### Fixed
+- Fixed Turnstile login retry reset in themes/login flows where previous click/enter hooks did not reliably trigger the widget reset.
+- Made login retry reset logic target the current Turnstile container dynamically instead of relying on a stale target id.
+- Added a fallback reset trigger when login error alerts are rendered on the login page.
+
 ## [1.0.7] - 2026-02-25
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnaudw38/nodebb-plugin-spam-be-gone",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Anti-spam plugin for NodeBB 4.x using Akismet, StopForumSpam API, ProjectHoneyPot, and Cloudflare Turnstile (Turnstile-only fork)",
   "main": "library.js",
   "scripts": {},

package/public/js/scripts.js

@@ -35,36 +35,48 @@ $(function () {
 		return input && input.value;
 	}
 
+	function getCurrentLoginTurnstileTargetId() {
+		var args = getTurnstileArgs();
+		return args && args.targetId;
+	}
+
 	function resetTurnstileWidget(targetId) {
 		if (typeof turnstile === 'undefined') {
-			return;
+			return false;
+		}
+		targetId = targetId || getCurrentLoginTurnstileTargetId();
+		if (!targetId) {
+			return false;
 		}
 		var widgetId = turnstileState.widgets[targetId];
 		if (widgetId === undefined || widgetId === null) {
-			return;
+			return false;
 		}
 		try {
 			turnstile.reset(widgetId);
+			return true;
 		} catch (err) {
 			// Ignore reset errors when the widget is already destroyed by navigation.
+			return false;
 		}
 	}
 
-	function scheduleLoginTurnstileReset(targetId) {
-		// Turnstile tokens are single-use. On failed login, NodeBB keeps the user on the
-		// same page, so we refresh the widget shortly after submit to allow a retry.
+	function scheduleLoginTurnstileReset() {
+		// Turnstile tokens are single-use. On failed login, NodeBB often keeps the user on the
+		// same page and may handle submission via AJAX/click handlers. We try multiple delayed resets.
 		turnstileState.loginResetTimers.forEach(function (timerId) {
 			window.clearTimeout(timerId);
 		});
 		turnstileState.loginResetTimers = [];
 
-		[1000, 2200, 4000].forEach(function (delay) {
+		[700, 1400, 2600, 4200].forEach(function (delay) {
 			var timerId = window.setTimeout(function () {
 				var onLoginPage = !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
 				if (!onLoginPage) {
 					return;
 				}
-				if (!document.getElementById(targetId)) {
+				var targetId = getCurrentLoginTurnstileTargetId();
+				if (!targetId || !document.getElementById(targetId)) {
 					return;
 				}
 				resetTurnstileWidget(targetId);
@@ -73,20 +85,24 @@ $(function () {
 		});
 	}
 
-	function bindLoginRetryReset(targetId) {
+	function bindLoginRetryReset() {
 		if (turnstileState.loginBindingsAttached) {
 			return;
 		}
 		turnstileState.loginBindingsAttached = true;
 
 		function loginSubmitTrigger() {
-			scheduleLoginTurnstileReset(targetId);
+			scheduleLoginTurnstileReset();
 		}
 
 		// Native capture listeners only (avoid duplicate handlers/race conditions with jQuery delegates).
 		document.addEventListener('click', function (ev) {
-			var btn = ev.target && ev.target.closest ? ev.target.closest('[component="login/submit"], #login [type="submit"], form[action*="/login"] [type="submit"]') : null;
-			if (btn) {
+			var btn = ev.target && ev.target.closest ? ev.target.closest('[component="login/submit"], #login [type="submit"], form[action*="/login"] [type="submit"], form[data-action="login"] [type="submit"], button[type="submit"]') : null;
+			if (!btn) {
+				return;
+			}
+			var inLogin = btn.closest && btn.closest('#login, form[action*="/login"], form[data-action="login"], [component="login"]');
+			if (inLogin || (ajaxify.data && ajaxify.data.tpl_url === 'login')) {
 				loginSubmitTrigger();
 			}
 		}, true);
@@ -100,14 +116,40 @@ $(function () {
 			if (!el || !el.closest) {
 				return;
 			}
-			var inLogin = el.closest('#login, form[action*="/login"], form[data-action="login"]');
-			if (inLogin) {
+			var inLogin = el.closest('#login, form[action*="/login"], form[data-action="login"], [component="login"]');
+			if (inLogin || (ajaxify.data && ajaxify.data.tpl_url === 'login')) {
 				loginSubmitTrigger();
 			}
 		}, true);
+
+		// Extra safety: reset again when a login error alert appears (covers AJAX flows that do not
+		// reliably trigger the expected submit/click path in some themes).
+		if (window.MutationObserver) {
+			var observer = new MutationObserver(function (mutations) {
+				var onLoginPage = !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
+				if (!onLoginPage) {
+					return;
+				}
+				for (var i = 0; i < mutations.length; i += 1) {
+					for (var j = 0; j < mutations[i].addedNodes.length; j += 1) {
+						var n = mutations[i].addedNodes[j];
+						if (!n || n.nodeType !== 1) {
+							continue;
+						}
+						var hasError = (n.matches && n.matches('.alert-danger, .alert-error, .text-danger, [component="alerts/error"]')) ||
+							(n.querySelector && n.querySelector('.alert-danger, .alert-error, .text-danger, [component="alerts/error"]'));
+						if (hasError) {
+							scheduleLoginTurnstileReset();
+							return;
+						}
+					}
+				}
+			});
+			observer.observe(document.body, { childList: true, subtree: true });
+		}
 	}
 
-	function renderTurnstileIfNeeded(isLoginPage) {
+function renderTurnstileIfNeeded(isLoginPage) {
 		var args = getTurnstileArgs();
 		if (!args || (isLoginPage && !args.addLoginTurnstile)) {
 			return;
@@ -125,7 +167,7 @@ $(function () {
 
 				if (target.dataset.turnstileRendered === '1') {
 					if (isLoginPage) {
-						bindLoginRetryReset(args.targetId);
+						bindLoginRetryReset();
 					}
 					return;
 				}
@@ -155,7 +197,7 @@ $(function () {
 				target.dataset.turnstileRendered = '1';
 				turnstileState.widgets[args.targetId] = widgetId;
 				if (isLoginPage) {
-					bindLoginRetryReset(args.targetId);
+					bindLoginRetryReset();
 				}
 			})
 			.catch(function () {