Release: 5e4ac8e (production, READY) · supersedes e5d664a
Change: PR #26 — Turnstile challenge renders on every arrival, not only full page loads
Status: Drafted — not yet posted
We fixed a defect in how the Cloudflare Turnstile challenge rendered on the account pages.
What was wrong. The challenge widget appeared only on pages loaded directly. If you arrived at Create account or Sign in by clicking a link inside the app, the challenge area stayed empty and the submit button stayed disabled — with no error message, because nothing had failed. Refreshing the page cleared it.
Why. The Turnstile script is fetched once per full page load, and the widget was being created only in response to that script's load event. A page reached by in-app navigation mounts after that event has already fired, so nothing ever asked the widget to render. The framework's script cache correctly declined to fetch the source a second time; the component was simply waiting for a signal that was never coming again.
Scope. The one-click judge path was not affected. Open the demo sits on the landing page, so its challenge renders on the initial page load and always worked. The defect only affected visitors who navigated to the account pages from elsewhere in the app.
What changed. The challenge is now a single shared component that renders on every way it can be reached — a direct page load, an in-app navigation after the script has loaded, and an in-app navigation while the script is still in flight. It also releases its widget when the page is left, so returning to a form always presents a fresh challenge.
No change to the security model. Verification is still delegated to Supabase Auth, and Turnstile remains the only abuse control on anonymous sign-in. No server-side verification code was touched, and only the public site key is ever sent to the browser.
Verification. Lint, type checks, and the 187-test unit suite pass. A regression test covering in-app navigation was added, since the previous suite reached these pages only by direct load — which is why the defect went unnoticed. The fix was confirmed in a browser across every arrival path and is live in production.
Log in or sign up for Devpost to join the conversation.