@arnaudw38/nodebb-plugin-spam-be-gone 1.0.7 → 1.0.8

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.0.9] - 2026-02-25
+
+### Fixed
+- Fixed login success flow causing an unnecessary Turnstile refresh shortly before redirect.
+- Login retry reset now triggers only when a login error is actually detected on the page.
+
+### Improved
+- Added navigation-aware cleanup (`beforeunload`/`pagehide`) to avoid reset races during successful login redirects.
+- Reworked login retry watcher to use short-lived DOM error detection + fallback polling instead of blind timed resets.
+
 ## [1.0.8] - 2026-02-25
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnaudw38/nodebb-plugin-spam-be-gone",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Anti-spam plugin for NodeBB 4.x using Akismet, StopForumSpam API, ProjectHoneyPot, and Cloudflare Turnstile (Turnstile-only fork)",
   "main": "library.js",
   "scripts": {},

package/public/js/scripts.js

@@ -9,6 +9,9 @@ $(function () {
 		widgets: {},
 		loginBindingsAttached: false,
 		loginResetTimers: [],
+		loginErrorObserver: null,
+		loginAttemptArmed: false,
+		navigatingAway: false,
 	};
 
 	function getTurnstileArgs() {
@@ -61,30 +64,109 @@ $(function () {
 		}
 	}
 
-	function scheduleLoginTurnstileReset() {
-		// Turnstile tokens are single-use. On failed login, NodeBB often keeps the user on the
-		// same page and may handle submission via AJAX/click handlers. We try multiple delayed resets.
+	function onLoginPageNow() {
+		return !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
+	}
+
+	function hasLoginErrorVisible() {
+		var selectors = [
+			'.alert-danger',
+			'.alert-error',
+			'[component="alerts"] .alert.alert-danger',
+			'[component="alerts/error"]',
+			'.login-error',
+			'.text-danger',
+		];
+		for (var i = 0; i < selectors.length; i += 1) {
+			var nodes = document.querySelectorAll(selectors[i]);
+			for (var j = 0; j < nodes.length; j += 1) {
+				var n = nodes[j];
+				if (n && (n.offsetParent !== null || (n.textContent && n.textContent.trim()))) {
+					return true;
+				}
+			}
+		}
+		return false;
+	}
+
+	function clearLoginResetTimers() {
 		turnstileState.loginResetTimers.forEach(function (timerId) {
 			window.clearTimeout(timerId);
 		});
 		turnstileState.loginResetTimers = [];
+	}
+
+	function disarmLoginAttemptWatch() {
+		turnstileState.loginAttemptArmed = false;
+		clearLoginResetTimers();
+		if (turnstileState.loginErrorObserver) {
+			try {
+				turnstileState.loginErrorObserver.disconnect();
+			} catch (err) {
+				// noop
+			}
+			turnstileState.loginErrorObserver = null;
+		}
+	}
+
+	function resetLoginTurnstileOnDetectedError() {
+		if (!turnstileState.loginAttemptArmed) {
+			return;
+		}
+		if (turnstileState.navigatingAway || !onLoginPageNow()) {
+			disarmLoginAttemptWatch();
+			return;
+		}
+		if (!hasLoginErrorVisible()) {
+			return;
+		}
+		var targetId = getCurrentLoginTurnstileTargetId();
+		if (targetId && document.getElementById(targetId)) {
+			resetTurnstileWidget(targetId);
+		}
+		disarmLoginAttemptWatch();
+	}
+
+	function scheduleLoginTurnstileReset() {
+		// Arm a short-lived watcher and reset only when an actual login error is rendered.
+		turnstileState.navigatingAway = false;
+		disarmLoginAttemptWatch();
+		turnstileState.loginAttemptArmed = true;
+
+		if (window.MutationObserver) {
+			turnstileState.loginErrorObserver = new MutationObserver(function () {
+				resetLoginTurnstileOnDetectedError();
+			});
+			turnstileState.loginErrorObserver.observe(document.body, { childList: true, subtree: true, characterData: true });
+		}
 
-		[700, 1400, 2600, 4200].forEach(function (delay) {
+		// Poll briefly as a fallback for themes that toggle classes/text without obvious DOM insertions.
+		[250, 600, 1000, 1600, 2400, 3400].forEach(function (delay) {
 			var timerId = window.setTimeout(function () {
-				var onLoginPage = !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
-				if (!onLoginPage) {
-					return;
-				}
-				var targetId = getCurrentLoginTurnstileTargetId();
-				if (!targetId || !document.getElementById(targetId)) {
-					return;
-				}
-				resetTurnstileWidget(targetId);
+				resetLoginTurnstileOnDetectedError();
 			}, delay);
 			turnstileState.loginResetTimers.push(timerId);
 		});
+
+		// Stop watching after a while to avoid stale observers.
+		var cleanupTimerId = window.setTimeout(function () {
+			if (!turnstileState.navigatingAway && onLoginPageNow()) {
+				// no-op: just let the user try again manually if no explicit error was detected
+			}
+			disarmLoginAttemptWatch();
+		}, 6000);
+		turnstileState.loginResetTimers.push(cleanupTimerId);
 	}
 
+	window.addEventListener('beforeunload', function () {
+		turnstileState.navigatingAway = true;
+		disarmLoginAttemptWatch();
+	});
+	window.addEventListener('pagehide', function () {
+		turnstileState.navigatingAway = true;
+		disarmLoginAttemptWatch();
+	});
+
 	function bindLoginRetryReset() {
 		if (turnstileState.loginBindingsAttached) {
 			return;
@@ -122,31 +204,6 @@ $(function () {
 			}
 		}, true);
 
-		// Extra safety: reset again when a login error alert appears (covers AJAX flows that do not
-		// reliably trigger the expected submit/click path in some themes).
-		if (window.MutationObserver) {
-			var observer = new MutationObserver(function (mutations) {
-				var onLoginPage = !ajaxify.data || !ajaxify.data.tpl_url || ajaxify.data.tpl_url === 'login';
-				if (!onLoginPage) {
-					return;
-				}
-				for (var i = 0; i < mutations.length; i += 1) {
-					for (var j = 0; j < mutations[i].addedNodes.length; j += 1) {
-						var n = mutations[i].addedNodes[j];
-						if (!n || n.nodeType !== 1) {
-							continue;
-						}
-						var hasError = (n.matches && n.matches('.alert-danger, .alert-error, .text-danger, [component="alerts/error"]')) ||
-							(n.querySelector && n.querySelector('.alert-danger, .alert-error, .text-danger, [component="alerts/error"]'));
-						if (hasError) {
-							scheduleLoginTurnstileReset();
-							return;
-						}
-					}
-				}
-			});
-			observer.observe(document.body, { childList: true, subtree: true });
-		}
 	}
 
 function renderTurnstileIfNeeded(isLoginPage) {