@arnaudw38/nodebb-plugin-spam-be-gone 1.0.6 → 1.0.8

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.0.9] - 2026-02-25
+
+### Fixed
+- Fixed login success flow causing an unnecessary Turnstile refresh shortly before redirect.
+- Login retry reset now triggers only when a login error is actually detected on the page.
+
+### Improved
+- Added navigation-aware cleanup (`beforeunload`/`pagehide`) to avoid reset races during successful login redirects.
+- Reworked login retry watcher to use short-lived DOM error detection + fallback polling instead of blind timed resets.
+
+## [1.0.8] - 2026-02-25
+
+### Fixed
+- Fixed Turnstile login retry reset in themes/login flows where previous click/enter hooks did not reliably trigger the widget reset.
+- Made login retry reset logic target the current Turnstile container dynamically instead of relying on a stale target id.
+- Added a fallback reset trigger when login error alerts are rendered on the login page.
+
 ## [1.0.7] - 2026-02-25
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnaudw38/nodebb-plugin-spam-be-gone",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Anti-spam plugin for NodeBB 4.x using Akismet, StopForumSpam API, ProjectHoneyPot, and Cloudflare Turnstile (Turnstile-only fork)",
   "main": "library.js",
   "scripts": {},

package/public/js/scripts.js

@@ -9,6 +9,9 @@ $(function () {
 		widgets: {},
 		loginBindingsAttached: false,
 		loginResetTimers: [],
+		loginErrorObserver: null,
+		loginAttemptArmed: false,
+		navigatingAway: false,
 	};
 
 	function getTurnstileArgs() {
@@ -35,58 +38,153 @@ $(function () {
 		return input && input.value;
 	}
 
+	function getCurrentLoginTurnstileTargetId() {
+		var args = getTurnstileArgs();
+		return args && args.targetId;
+	}
+
 	function resetTurnstileWidget(targetId) {
 		if (typeof turnstile === 'undefined') {
-			return;
+			return false;
+		}
+		targetId = targetId || getCurrentLoginTurnstileTargetId();
+		if (!targetId) {
+			return false;
 		}
 		var widgetId = turnstileState.widgets[targetId];
 		if (widgetId === undefined || widgetId === null) {
-			return;
+			return false;
 		}
 		try {
 			turnstile.reset(widgetId);
+			return true;
 		} catch (err) {
 			// Ignore reset errors when the widget is already destroyed by navigation.
+			return false;
+		}
+	}
+
+	function onLoginPageNow() {
+		return !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
+	}
+
+	function hasLoginErrorVisible() {
+		var selectors = [
+			'.alert-danger',
+			'.alert-error',
+			'[component="alerts"] .alert.alert-danger',
+			'[component="alerts/error"]',
+			'.login-error',
+			'.text-danger',
+		];
+		for (var i = 0; i < selectors.length; i += 1) {
+			var nodes = document.querySelectorAll(selectors[i]);
+			for (var j = 0; j < nodes.length; j += 1) {
+				var n = nodes[j];
+				if (n && (n.offsetParent !== null || (n.textContent && n.textContent.trim()))) {
+					return true;
+				}
+			}
 		}
+		return false;
 	}
 
-	function scheduleLoginTurnstileReset(targetId) {
-		// Turnstile tokens are single-use. On failed login, NodeBB keeps the user on the
-		// same page, so we refresh the widget shortly after submit to allow a retry.
+	function clearLoginResetTimers() {
 		turnstileState.loginResetTimers.forEach(function (timerId) {
 			window.clearTimeout(timerId);
 		});
 		turnstileState.loginResetTimers = [];
+	}
 
-		[1000, 2200, 4000].forEach(function (delay) {
+	function disarmLoginAttemptWatch() {
+		turnstileState.loginAttemptArmed = false;
+		clearLoginResetTimers();
+		if (turnstileState.loginErrorObserver) {
+			try {
+				turnstileState.loginErrorObserver.disconnect();
+			} catch (err) {
+				// noop
+			}
+			turnstileState.loginErrorObserver = null;
+		}
+	}
+
+	function resetLoginTurnstileOnDetectedError() {
+		if (!turnstileState.loginAttemptArmed) {
+			return;
+		}
+		if (turnstileState.navigatingAway || !onLoginPageNow()) {
+			disarmLoginAttemptWatch();
+			return;
+		}
+		if (!hasLoginErrorVisible()) {
+			return;
+		}
+		var targetId = getCurrentLoginTurnstileTargetId();
+		if (targetId && document.getElementById(targetId)) {
+			resetTurnstileWidget(targetId);
+		}
+		disarmLoginAttemptWatch();
+	}
+
+	function scheduleLoginTurnstileReset() {
+		// Arm a short-lived watcher and reset only when an actual login error is rendered.
+		turnstileState.navigatingAway = false;
+		disarmLoginAttemptWatch();
+		turnstileState.loginAttemptArmed = true;
+
+		if (window.MutationObserver) {
+			turnstileState.loginErrorObserver = new MutationObserver(function () {
+				resetLoginTurnstileOnDetectedError();
+			});
+			turnstileState.loginErrorObserver.observe(document.body, { childList: true, subtree: true, characterData: true });
+		}
+
+		// Poll briefly as a fallback for themes that toggle classes/text without obvious DOM insertions.
+		[250, 600, 1000, 1600, 2400, 3400].forEach(function (delay) {
 			var timerId = window.setTimeout(function () {
-				var onLoginPage = !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
-				if (!onLoginPage) {
-					return;
-				}
-				if (!document.getElementById(targetId)) {
-					return;
-				}
-				resetTurnstileWidget(targetId);
+				resetLoginTurnstileOnDetectedError();
 			}, delay);
 			turnstileState.loginResetTimers.push(timerId);
 		});
+
+		// Stop watching after a while to avoid stale observers.
+		var cleanupTimerId = window.setTimeout(function () {
+			if (!turnstileState.navigatingAway && onLoginPageNow()) {
+				// no-op: just let the user try again manually if no explicit error was detected
+			}
+			disarmLoginAttemptWatch();
+		}, 6000);
+		turnstileState.loginResetTimers.push(cleanupTimerId);
 	}
 
-	function bindLoginRetryReset(targetId) {
+	window.addEventListener('beforeunload', function () {
+		turnstileState.navigatingAway = true;
+		disarmLoginAttemptWatch();
+	});
+	window.addEventListener('pagehide', function () {
+		turnstileState.navigatingAway = true;
+		disarmLoginAttemptWatch();
+	});
+
+	function bindLoginRetryReset() {
 		if (turnstileState.loginBindingsAttached) {
 			return;
 		}
 		turnstileState.loginBindingsAttached = true;
 
 		function loginSubmitTrigger() {
-			scheduleLoginTurnstileReset(targetId);
+			scheduleLoginTurnstileReset();
 		}
 
 		// Native capture listeners only (avoid duplicate handlers/race conditions with jQuery delegates).
 		document.addEventListener('click', function (ev) {
-			var btn = ev.target && ev.target.closest ? ev.target.closest('[component="login/submit"], #login [type="submit"], form[action*="/login"] [type="submit"]') : null;
-			if (btn) {
+			var btn = ev.target && ev.target.closest ? ev.target.closest('[component="login/submit"], #login [type="submit"], form[action*="/login"] [type="submit"], form[data-action="login"] [type="submit"], button[type="submit"]') : null;
+			if (!btn) {
+				return;
+			}
+			var inLogin = btn.closest && btn.closest('#login, form[action*="/login"], form[data-action="login"], [component="login"]');
+			if (inLogin || (ajaxify.data && ajaxify.data.tpl_url === 'login')) {
 				loginSubmitTrigger();
 			}
 		}, true);
@@ -100,14 +198,15 @@ $(function () {
 			if (!el || !el.closest) {
 				return;
 			}
-			var inLogin = el.closest('#login, form[action*="/login"], form[data-action="login"]');
-			if (inLogin) {
+			var inLogin = el.closest('#login, form[action*="/login"], form[data-action="login"], [component="login"]');
+			if (inLogin || (ajaxify.data && ajaxify.data.tpl_url === 'login')) {
 				loginSubmitTrigger();
 			}
 		}, true);
+
 	}
 
-	function renderTurnstileIfNeeded(isLoginPage) {
+function renderTurnstileIfNeeded(isLoginPage) {
 		var args = getTurnstileArgs();
 		if (!args || (isLoginPage && !args.addLoginTurnstile)) {
 			return;
@@ -125,7 +224,7 @@ $(function () {
 
 				if (target.dataset.turnstileRendered === '1') {
 					if (isLoginPage) {
-						bindLoginRetryReset(args.targetId);
+						bindLoginRetryReset();
 					}
 					return;
 				}
@@ -155,7 +254,7 @@ $(function () {
 				target.dataset.turnstileRendered = '1';
 				turnstileState.widgets[args.targetId] = widgetId;
 				if (isLoginPage) {
-					bindLoginRetryReset(args.targetId);
+					bindLoginRetryReset();
 				}
 			})
 			.catch(function () {