Changeset 3742524

Timestamp:

10/12/2026 09:25:15 PM (13 days ago)

Author:

webdigitech

Message:

Release TrueSift WordPress 1.1.0 - Next SDK 0.4.0 and Behavioral Signals v2

Location:

truesift/trunk

Files:

• CHANGELOG.md (modified) (1 diff)
• THIRD-PARTY-NOTICES.txt (modified) (2 diffs)
• includes/class-truesift-api-client.php (modified) (2 diffs)
• includes/class-truesift-privacy.php (modified) (1 diff)
• public/assets/truesift-public.js (modified) (4 diffs)
• public/assets/truesift-sdk-0.3.0.js (deleted)
• public/assets/truesift-sdk-0.4.0.js (added)
• readme.txt (modified) (6 diffs)
• truesift.php (modified) (2 diffs)

truesift/trunk/CHANGELOG.md

@@ -1 +1 @@
 # Changelog
+
+## 1.1.0 - 2026-10-12
+
+### SDK and Behavioral Signals v2
+
+- Updated the WordPress React (`wp-element`) client adapter to `@truesift/next@0.4.0`, retaining the existing WordPress REST bridge and server-side proof validation.
+- Added optional aggregate Behavioral Signals v2: sampled pointer movements and scrolls, pointer presses, touch, keyboard event counts, focus/blur, visibility changes, challenge interaction counts and timing. Raw keys, coordinates, and form content are never recorded.
+- Adopted the SDK's cancellation-safe 2,500 ms observation window, per-check collector reset, and event-listener cleanup on success, error, retry and unmount.
+- Updated the PHP `clientSignals` allowlist to relay permitted numeric v2 fields and `telemetryVersion: 2`, while retaining legacy v1 field support and excluding unknown or non-numeric data.
+
+### WordPress integration and packaging
+
+- Release detached React roots when WooCommerce/AJAX form fragments are removed, so in-flight checks are aborted and listeners are released without clearing existing valid proofs or interrupting still-connected mounts.
+- Preserved public WordPress password reset protection and administrative reset compatibility (1.0.20), Fluent Forms AJAX verification (1.0.21), and the established WordPress, WooCommerce, Contact Form 7, WPForms and Elementor integrations.
+- Preserved the static SVG visual fallback and removed unused dotLottie runtime/animation modules from the WordPress-only bundle.
+- Updated the WordPress Privacy Policy Guide wording and bundled SDK license notice for the Behavioral Signals v2 release.
+- Kept the established server-side challenge/verify/proof endpoints and contract version `0.2`; no Backend or SDK package was changed.
+- Set SDK asset revision to `1.1.0-0.4.0`, with WordPress plugin version `1.1.0`.
 
 ## 1.0.21 - 2026-10-03

truesift/trunk/THIRD-PARTY-NOTICES.txt

@@ -1 +1 @@
 # Third-party notices
 
-## `@truesift/next` 0.3.0
+## `@truesift/next` 0.4.0
 
-The readable browser bundle in `public/assets/truesift-sdk-0.3.0.js` contains
+The readable browser bundle in `public/assets/truesift-sdk-0.4.0.js` contains
 client-side portions of the official `@truesift/next` package, adapted to use
-the React runtime supplied by WordPress through `wp-element`.
+the React runtime supplied by WordPress through `wp-element`. The WordPress
+adapter retains the SDK's Behavioral Signals v2 collection and verification
+lifecycle but uses the static SVG visual fallback. No server-side SDK code
+is shipped in the browser bundle.
 
 Copyright © 2026 WebDigiTech
@@ -36 +39 @@
 ## Animation runtime
 
-The optional dotLottie runtime and animation asset from the Next.js SDK are
-not distributed in this WordPress release. The official TrueSift static SVG
-fallback is used instead. This keeps the plugin self-contained and avoids an
-unnecessary third-party animation dependency.
+The optional dotLottie runtime and third-party Lottie animation asset from
+the Next.js SDK are not distributed in this WordPress release. The official
+TrueSift static SVG fallback is used instead. This keeps the plugin
+self-contained and avoids an unnecessary third-party animation dependency.

truesift/trunk/includes/class-truesift-api-client.php

@@ -603 +603 @@
     private function sanitizeClientSignals(array $signals): array
     {
-        $allowed = array('elapsedMs', 'honeypotValue', 'interactionCount', 'pointerMoveCount', 'keyPressCount', 'focusCount', 'blurCount', 'checkedAt');
+        // Mirror the optional, aggregate-only v2 fields from @truesift/next.
+        // The v1 numeric counters remain accepted for existing browser clients.
+        $numericFields = array(
+            'elapsedMs',
+            'interactionCount',
+            'pointerMoveCount',
+            'pointerDownCount',
+            'scrollCount',
+            'touchCount',
+            'visibilityChangeCount',
+            'challengeInteractionCount',
+            'firstInteractionDelayMs',
+            'activeDurationMs',
+            'keyPressCount',
+            'focusCount',
+            'blurCount',
+        );
         $result = array();
 
-        foreach ($allowed as $key) {
+        if (isset($signals['telemetryVersion']) && $signals['telemetryVersion'] === 2) {
+            $result['telemetryVersion'] = 2;
+        }
+
+        foreach ($numericFields as $key) {
             if (!array_key_exists($key, $signals)) {
                 continue;
@@ -613 +633 @@
             $value = $signals[$key];
 
-            if (is_string($value)) {
-                $result[$key] = substr(sanitize_text_field($value), 0, 500);
-            } elseif (is_numeric($value)) {
-                $result[$key] = (float) $value;
+            if ((is_int($value) || is_float($value)) && is_finite((float) $value)) {
+                $result[$key] = $value;
+            }
+        }
+
+        foreach (array('honeypotValue', 'checkedAt') as $key) {
+            if (isset($signals[$key]) && is_string($signals[$key])) {
+                $result[$key] = substr(sanitize_text_field($signals[$key]), 0, 500);
             }
         }

truesift/trunk/includes/class-truesift-privacy.php

@@ -14 +14 @@
 
         $content = '<p>' . esc_html__(
-            'This website uses TrueSift to protect selected public forms from automated abuse. When a protected form is displayed, technical verification data is sent to the TrueSift service. This can include the site key, requested action, page path, website origin, browser language, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, verification timing, and a short-lived challenge token.',
+            'This website uses TrueSift to protect selected public forms from automated abuse. When a protected form is displayed, technical verification data is sent to the TrueSift service. This can include the site key, requested action, page path, website origin, browser language, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, verification timing, and a short-lived challenge token. Optional temporary Behavioral Signals v2 include aggregate counts of pointer, keyboard, scroll, touch, focus, blur and visibility activity, and interaction timing; no typed keys, pointer coordinates or form content are collected.',
             'truesift'
         ) . '</p>';

truesift/trunk/public/assets/truesift-public.js

@@ -8 +8 @@
   const mountStates = new WeakMap();
   const trackedForms = new Set();
+  const trackedMounts = new Set();
   const PROOF_EXPIRY_SAFETY_MS = 15000;
   const AUTOMATIC_RETRY_DELAYS_MS = [1200, 3000, 7000];
@@ -783 +784 @@
       };
       mountStates.set(mount, mountState);
+      trackedMounts.add(mount);
     }
 
@@ -1145 +1147 @@
   }
 
+  function cleanupDisconnectedMounts() {
+    trackedMounts.forEach((mount) => {
+      if (mount.isConnected) {
+        return;
+      }
+
+      const mountState = mountStates.get(mount);
+
+      if (mountState?.root && typeof mountState.root.unmount === "function") {
+        mountState.root.unmount();
+      } else if (typeof element.unmountComponentAtNode === "function") {
+        element.unmountComponentAtNode(mount);
+      }
+
+      mountStates.delete(mount);
+      trackedMounts.delete(mount);
+
+      // A detached WooCommerce or AJAX fragment no longer owns a verification
+      // run. Its React unmount aborts pending requests and disposes collectors.
+      // Allow an incoming replacement mount to start one fresh run, but never
+      // clear an existing valid proof or a check owned by another live mount.
+      trackedForms.forEach((form) => {
+        const state = formStates.get(form);
+
+        if (!state || !state.mounts.delete(mount)) {
+          return;
+        }
+
+        if (state.checking &&
+            !Array.from(state.mounts).some((candidate) => candidate.isConnected)) {
+          state.checking = false;
+          state.refreshing = false;
+        }
+      });
+    });
+  }
+
   function cleanupDisconnectedForms() {
     trackedForms.forEach((form) => {
@@ -1260 +1299 @@
   function initDynamicObserver() {
     const observer = new MutationObserver((mutations) => {
+      cleanupDisconnectedMounts();
       cleanupDisconnectedForms();
       mutations.forEach((mutation) => {

truesift/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 8.1
-Stable tag: 1.0.21
+Stable tag: 1.1.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -15 +15 @@
 TrueSift connects WordPress forms to the TrueSift verification service. It starts an automated browser challenge when a protected form is displayed, keeps the form submit action unavailable until an authoritative verification token is issued, and validates and atomically consumes that single-use token on the WordPress server before the protected action continues.
 
-The plugin does not implement a separate CAPTCHA protocol. Its browser runtime tracks the public `@truesift/next` 0.3.0 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts.
+The plugin does not implement a separate CAPTCHA protocol. Its browser runtime tracks the public `@truesift/next` 0.4.0 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts.
 
 = Included integrations =
@@ -41 +41 @@
 The plugin sends the token together with a signed WordPress form context to the server. The PHP verifier calls TrueSift's proof endpoint with server-owned credentials and expected action, path, and origin. A normal success is accepted only when TrueSift confirms `allowed: true`, `decision: allow`, and atomic consumption through either `consumed: true` or a non-empty `consumedAt` timestamp. Replayed, expired, invalid, mismatched, reviewed, or blocked proofs are rejected.
 
-The bundled SDK 0.3.0 adapter may send only aggregate in-memory interaction counters for the current verification window, such as pointer, keyboard, focus, and blur counts. It does not send pointer coordinates, pressed keys, form contents, device fingerprints, or persistent visitor identifiers. Missing or insufficient behavioral telemetry remains neutral.
+The bundled SDK 0.4.0 adapter may send optional Behavioral Signals v2 aggregates for the current verification window: pointer movements and presses, keyboard events, scroll and touch activity, focus, blur, visibility changes, interaction counts, and observation/interaction timing. The SDK samples high-frequency pointer and scroll activity and frees event listeners after verification or unmount. It does not send pointer coordinates, pressed keys, form contents, device fingerprints, or persistent visitor identifiers. Older clients without v2 telemetry remain compatible; missing or insufficient behavioral telemetry remains neutral.
 
 = Visual modes =
@@ -82 +82 @@
 * Authoritative single-use proof verification directly from the protected WordPress server action to `https://api.truesift.de/api/v1/botguard/proof/verify`
 
-Data sent can include the site key, requested action, page path, website origin, browser language, languages, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, challenge identifiers, short-lived challenge tokens, verification timing, aggregate interaction counters for the active verification window, and the single-use verification token. The behavioral counters contain counts only and do not contain pointer coordinates, actual pressed keys, form contents, fingerprints, or persistent visitor identifiers. The secret key is sent only server-to-server and is never exposed to the browser.
+Data sent can include the site key, requested action, page path, website origin, browser language, languages, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, challenge identifiers, short-lived challenge tokens, verification timing, aggregate pointer, keyboard, scroll, touch, focus, blur, visibility and interaction counters for the active verification window, and the single-use verification token. The behavioral counters contain counts only and do not contain pointer coordinates, actual pressed keys, form contents, fingerprints, or persistent visitor identifiers. The secret key is sent only server-to-server and is never exposed to the browser.
 
 TrueSift service information: https://truesift.de/
@@ -128 +128 @@
 = Does the plugin collect local analytics? =
 
-No. Version 1.0.21 does not create a local analytics database or visitor profile. Debug mode stores only administrator troubleshooting events and is disabled by default.
+No. TrueSift does not create a local analytics database or visitor profile. Debug mode stores only administrator troubleshooting events and is disabled by default.
 
 = Can I use the shortcode with any form? =
@@ -149 +149 @@
 
 == Changelog ==
+
+= 1.1.0 =
+* Updated the WordPress browser adapter to the official `@truesift/next@0.4.0` client and shared protocol, while retaining the existing WordPress REST and PHP proof-validation architecture.
+* Added optional, privacy-conscious Behavioral Signals v2 aggregates for pointer, keyboard, scroll, touch, focus, blur, visibility, and interaction timing without capturing event contents, pointer coordinates, or form values.
+* Preserved cancellation-safe observation and automatic verification, with a 2.5-second minimum observation window and listener cleanup after verification or unmount.
+* Extended the PHP verification bridge's strict field allowlist for Behavioral v2 and retained compatibility with legacy v1 clients.
+* Released detached React roots when dynamic form fragments are removed; preserved valid proofs and avoided duplicate checks on live replacement mounts.
+* Kept WordPress login, registration and public password reset protections, administrator-initiated reset compatibility, Fluent Forms AJAX proof validation, and the other supported integrations unchanged.
+* Continued to use the bundled static SVG fallback, without third-party dotLottie runtime or animation asset.
+* SDK browser asset revision: `1.1.0-0.4.0`. The server-side proof contract remains unchanged.
 
 = 1.0.21 =

truesift/trunk/truesift.php

@@ -4 +4 @@
  * Plugin URI:        https://truesift.de/
  * Description:       Privacy-first automated human verification for WordPress forms, WooCommerce, and popular form plugins.
- * Version:           1.0.21
+ * Version:           1.1.0
  * Requires at least: 6.6
  * Requires PHP:      8.1
@@ -21 +21 @@
 }
 
-define('TRUESIFT_PLUGIN_VERSION', '1.0.21');
-define('TRUESIFT_SDK_VERSION', '0.3.0');
+define('TRUESIFT_PLUGIN_VERSION', '1.1.0');
+define('TRUESIFT_SDK_VERSION', '0.4.0');
 define('TRUESIFT_CONTRACT_VERSION', '0.2');
-define('TRUESIFT_BEHAVIORAL_SIGNALS_VERSION', '1');
-define('TRUESIFT_SDK_BUNDLE', 'truesift-sdk-0.3.0.js');
+define('TRUESIFT_BEHAVIORAL_SIGNALS_VERSION', '2');
+define('TRUESIFT_SDK_BUNDLE', 'truesift-sdk-0.4.0.js');
 define('TRUESIFT_SDK_ASSET_VERSION', TRUESIFT_PLUGIN_VERSION . '-' . TRUESIFT_SDK_VERSION);
 define('TRUESIFT_PLUGIN_FILE', __FILE__);