Add Cloudflare Turnstile CAPTCHA support for spam protection with configuration, validation, and UI integration; enhance form inputs to retain old values; include middleware to handle fbclid query parameter; update dependencies and documentation accordingly. #major (#41)

* Add Cloudflare Turnstile CAPTCHA support for spam protection with configuration, validation, and UI integration; enhance form inputs to retain old values; include middleware to handle fbclid query parameter; update dependencies and documentation accordingly.

* Move 'spam_redirects' configuration to a higher position in the forms config for better organization.

* #major

* Update environment variable defaults in README and expand package version compatibility in composer.json to support multiple versions of laravel-cloudflare-turnstile.

* Bump actions/checkout from 4 to 5 (#37)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Joshua Mitchener <[email protected]>

* Add support for fbclid parameter in form data handling and validation to track Facebook click identifiers.

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: 2 people

.github/workflows/auto-release.yml

@@ -25,7 +25,7 @@ jobs:
           application_id: ${{ vars.FUELVIEWS_BOT_APP_ID }}
           application_private_key: ${{ secrets.FUELVIEWS_BOT_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: 'main'
           fetch-depth: '0'

.github/workflows/dependabot-auto-merge.yml

@@ -25,7 +25,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Dependabot metadata
         id: metadata

.github/workflows/php-cs-fixer.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ github.head_ref }}
 

.github/workflows/run-tests.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to `laravel-forms` will be documented in this file.
 
+## v1.0.0 - 2025-09-27
+
+### What's Changed
+
+* Add Cloudflare Turnstile CAPTCHA support for spam protection with configuration, validation, and UI integration; enhance form inputs to retain old values; include middleware to handle fbclid query parameter; update dependencies and documentation accordingly. #major by @thejmitchener in https://github.com/fuelviews/laravel-forms/pull/41
+
+**Full Changelog**: https://github.com/fuelviews/laravel-forms/compare/v0.0.25...v1.0.0
+
 ## v0.0.25 - 2025-09-27
 
 ### What's Changed

README.md

@@ -1,6 +1,6 @@
 # Laravel forms package
 
-Laravel forms package
+Laravel forms package with built-in spam protection and optional Cloudflare Turnstile support.
 
 ## Installation
 
@@ -28,6 +28,38 @@ You can publish the view files with:
 php artisan vendor:publish --tag="forms-views"
 ```
 
+## Cloudflare Turnstile Setup (Optional)
+
+This package includes built-in support for Cloudflare Turnstile CAPTCHA to protect your forms from spam.
+
+### 1. Get Your Turnstile Keys
+
+1. Sign up for a free [Cloudflare account](https://dash.cloudflare.com/sign-up) if you don't have one
+2. Go to the [Turnstile dashboard](https://dash.cloudflare.com/?to=/:account/turnstile)
+3. Create a new site and get your Site Key and Secret Key
+
+### 2. Configure Your Environment
+
+Add these to your `.env` file:
+
+```env
+FORMS_TURNSTILE_ENABLED=true
+TURNSTILE_SITE_KEY=your_site_key_here
+TURNSTILE_SECRET_KEY=your_secret_key_here
+```
+
+### Configuration Options
+
+The package configuration in `config/forms.php` supports flexible environment variables:
+
+```php
+    'turnstile' => [
+        'enabled' => env('FORMS_TURNSTILE_ENABLED', false),
+        'site_key' => env('TURNSTILE_SITE_KEY','1x00000000000000000000AA'),
+        'secret_key' => env('TURNSTILE_SECRET_KEY','1x0000000000000000000000000000000AA'),
+    ],
+```
+
 ## Form Usage (basic)
 
 Include form method type, form method route, spam strap in the start and end of the form, form key, fake submit button, and a real submit button.
@@ -63,6 +95,7 @@ Include form method type, form method route, spam strap in the start and end of
                     name="firstName"
                     id="firstName"
                     wire:model="firstName"
+                    value="{{ old('firstName') }}"
                     autocomplete="given-name"
                     class="block w-full rounded-md border-0 px-3.5 py-2 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"
                     pattern="[A-Za-z]{2,}"
@@ -82,6 +115,7 @@ Include form method type, form method route, spam strap in the start and end of
                     name="first-name"
                     id="lastName"
                     wire:model="lastName"
+                    value="{{ old('lastName') }}"
                     autocomplete="family-name"
                     class="block w-full rounded-md border-0 px-3.5 py-2 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"
                     pattern=".{2,}"
@@ -101,6 +135,7 @@ Include form method type, form method route, spam strap in the start and end of
                     name="email"
                     type="email"
                     wire:model="email"
+                    value="{{ old('email') }}"
                     autocomplete="email"
                     class="block w-full rounded-md border-0 px-3.5 py-2 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6" />
                 @error('email')
@@ -118,6 +153,7 @@ Include form method type, form method route, spam strap in the start and end of
                     name="phone"
                     id="phone"
                     wire:model="phone"
+                    value="{{ old('phone') }}"
                     autocomplete="tel"
                     aria-describedby="phone-description"
                     class="block w-full rounded-md border-0 px-3.5 py-2 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"
@@ -141,6 +177,7 @@ Include form method type, form method route, spam strap in the start and end of
                     id="message"
                     name="message"
                     wire:model="message"
+                    value="{{ old('messsage') }}"
                     rows="4"
                     aria-describedby="message-description"
                     class="block w-full rounded-md border-0 px-3.5 py-2 text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 placeholder:text-gray-400 focus:ring-2 focus:ring-inset focus:ring-indigo-600 sm:text-sm sm:leading-6"></textarea>
@@ -178,7 +215,7 @@ Add laravel-forms to your tailwind.config.js file.
 
 ```javascript
 content: [
-    './vendor/fuelviews/laravel-forms/resources/**/*.php'
+    './vendor/fuelviews/laravel-forms/resources/**/*.blade.php',
 ]
 ```
 

composer.json

@@ -18,7 +18,8 @@
     "require": {
         "php": "^8.3",
         "spatie/laravel-package-tools": "^1.16",
-        "illuminate/contracts": "^10.0||^11.0||^12.0"
+        "illuminate/contracts": "^10.0||^11.0||^12.0",
+        "ryangjchandler/laravel-cloudflare-turnstile": "^2.0||^1.1"
     },
     "require-dev": {
         "fuelviews/laravel-sabhero-wrapper": ">=0.0",
@@ -30,7 +31,7 @@
         "pestphp/pest-plugin-arch": "^3.0||^2.7",
         "pestphp/pest-plugin-laravel": "^3.2||^2.3",
         "rector/rector": "^2.0",
-        "driftingly/rector-laravel": "^2.0"
+        "driftingly/rector-laravel": "^2.0||^1.0"
     },
     "autoload": {
         "psr-4": {

config/forms.php

@@ -92,4 +92,10 @@
         'yelp' => 'https://yelp.com',
         'bbb' => 'https://bbb.org',
     ],
+
+    'turnstile' => [
+        'enabled' => env('FORMS_TURNSTILE_ENABLED', false),
+        'site_key' => env('TURNSTILE_SITE_KEY','1x00000000000000000000AA'),
+        'secret_key' => env('TURNSTILE_SECRET_KEY','1x0000000000000000000000000000000AA'),
+    ],
 ];

resources/views/components/steps/step-one.blade.php

@@ -6,7 +6,7 @@
         <input type="text" name="gotcha" style="display:none" />
 
         <div class="col-span-2">
-            <div class="flex space-x-2 pt-4">
+            <div class="flex flex-wrap gap-x-2 gap-y-6 pt-4">
                 @foreach (config('forms.modal.steps.1.locations') as $location)
                     <div>
                         <x-forms::buttons.location-button :location="$location" />

resources/views/components/steps/step-two.blade.php

@@ -69,6 +69,32 @@
         <div class="sm:col-span-2">
             <x-forms::error :errorKey="'form.submit.limit'" />
         </div>
+
+        @if(config('forms.turnstile.enabled') && config('forms.turnstile.site_key'))
+        <div class="sm:col-span-2">
+            <div
+                x-data="{
+                    initTurnstile() {
+                        if (typeof turnstile !== 'undefined' && this.$el.querySelector('.cf-turnstile')) {
+                            const container = this.$el.querySelector('.cf-turnstile');
+                            if (!container.hasChildNodes() || container.children.length === 0) {
+                                turnstile.render(container, {
+                                    sitekey: '{{ config('forms.turnstile.site_key') }}',
+                                    callback: function(token) {
+                                        @this.set('turnstileToken', token);
+                                    }
+                                });
+                            }
+                        }
+                    }
+                }"
+                x-init="$nextTick(() => { setTimeout(() => initTurnstile(), 500); })"
+                wire:ignore
+            >
+                <div class="cf-turnstile" data-sitekey="{{ config('forms.turnstile.site_key') }}"></div>
+            </div>
+        </div>
+        @endif
     </div>
 
     <input type="text" name="gotcha" class="hidden" />