fix(captcha): scope the booking refresh to its form and make the ids unique (#1057)

* test: attribute the security-fields renderer to the class it exercises

Coveralls reported `SecurityService` at 25% patch coverage — 2 of the 8 changed
lines — with the whole body of `render_security_fields()` uncovered, even
though `test_render_security_fields_composes_honeypot_and_challenge` calls it
and asserts on its output.

The method was never untested; the report was filtered. `@covers` restricts
attribution to the classes it names, and this test class named only the two
captcha ones, so everything the composition tests executed inside
`SecurityService` was discarded. Adding it to `@covers` — with the
`class_exists()` preload CLAUDE.md prescribes for the pcov gotcha — takes the
file from 67/73 to 72/73; the one line left is the `exit` in the ABSPATH guard,
unreachable by construction.

No assertion changed. This makes the coverage report describe what the suite
actually does, so a later reader does not "add a test" for a covered method or
read it as dead.

Refs #1053

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XWx9qJdjZdAq8crxM9GCU

* fix(captcha): scope the booking refresh to its form and make the ids unique

The plugin supports several forms on one page on purpose — DynamicFragments
has a branch that mints a distinct challenge per form — but the captcha did not
hold up under it.

`ffcCalendarFrontend.refreshCaptcha()` was page-global. It rewrote the question
in *every* `.ffc-captcha-row` on the page, then wrote the new token through
`$('#ffc_captcha_hash')`, which by definition matches only the first element.
With two forms up, a rejection in either one left the second displaying a
question its token did not answer: the visitor answered what was on screen and
was told the math answer is incorrect — true, and useless as a diagnosis.

It now scopes to the submitted form and matches by `name`, which is what
`ffc-frontend-helpers.js` already did on the certificate path. `$form` was
already in scope at the call site, so nothing had to be restructured.

That leaves the ids used only for the `<label for>` pair, and a census
confirmed it: every other consumer — ffc-dynamic-fragments, ffc-frontend,
ffc-frontend-helpers — matches by `name`, and no CSS references them. Duplicate
ids still broke the label association a screen reader needs to announce a
required field, so `MathCaptcha` now suffixes them per render. The `name`
attributes are the contract with the server and are untouched.

Three of the four new JS tests fail against the previous implementation and
pass against this one, so they pin the defect rather than describing the fix.

Also carries a test-attribution fix that missed the #1055 merge window: that
class `@covers` SecurityService, taking the file from 67/73 to 72/73 — the
method was always tested, the report was filtered.

On the timer sweep this issue also lists: the inventory is 16 timers of 1000ms
or more, several loaded by tests that do not fake timers. But three runs of the
full JS suite produced zero unhandled errors, so nothing beyond the instance
already fixed is observably leaking. Adding fake timers to five passing test
files on a static heuristic would be churn; the inventory is recorded on the
issue for whoever has a reproduction.

Refs #1056, #1053

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XWx9qJdjZdAq8crxM9GCU

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: rpgmem

CHANGELOG.md

@@ -15,6 +15,10 @@ The format follows [Keep a Changelog] (https://keepachangelog.com/en/1.1.0/).
 
 - Internal (#1053) — o captcha passa a ter um contrato de estratégia (`CaptchaProviderInterface` + `CaptchaProvider::resolve()`), com o desafio matemático atrás dele. Os 6 sites de verificação e os 4 de retry não mudam: `validate_security_fields()` continua sendo o ponto único e agora delega a metade captcha. As duas cópias do bloco de segurança viraram uma, em `templates/`.
 
+### Fixed
+
+- **O captcha se atrapalhava com dois formulários na mesma página** (#1056): o refresh do agendamento reescrevia a pergunta em *todos* os formulários mas, casando por id, trocava o token só do primeiro — o segundo passava a exibir uma pergunta que seu token não respondia. Agora é escopado ao formulário e casa por `name`. Os ids do captcha passam a ser únicos por render, corrigindo também a associação `<label for>` para leitores de tela.
+
 ## [6.22.0] (2026-09-04) — `aa5ba5b`
 
 ### Deprecated

assets/js/ffc-calendar-frontend.js

@@ -371,7 +371,7 @@
                     $submitBtn.data('submitting', false);
                     if (err && err.fromServer) {
                         if (err.data && err.data.refresh_captcha) {
-                            self.refreshCaptcha(err.data.new_label, err.data.new_hash);
+                            self.refreshCaptcha($form, err.data.new_label, err.data.new_hash);
                         }
                         self.showError(err.message || ffcCalendar.strings.error);
                     } else {
@@ -507,16 +507,29 @@
         },
 
         /**
-         * Refresh captcha with new question
+         * Refresh captcha with new question, scoped to the submitted form.
+         *
+         * Was page-global (#1056): it rewrote the question in *every* captcha
+         * row on the page but, matching by id, updated only the *first* hidden
+         * token. With two forms on one page — a configuration the plugin
+         * supports on purpose — the second ended up showing the new question
+         * while holding the old token, so answering what was on screen failed
+         * with "the math answer is incorrect", which is true and useless.
+         *
+         * Now scoped to $form and matched by name, like ffc-frontend-helpers.
+         *
+         * @param {Object} $form    jQuery object for the form being refreshed.
+         * @param {string} newLabel New challenge question.
+         * @param {string} newHash  New challenge token.
          */
-        refreshCaptcha: function(newLabel, newHash) {
-            if (!newLabel || !newHash) {
+        refreshCaptcha: function($form, newLabel, newHash) {
+            if (!$form || !$form.length || !newLabel || !newHash) {
                 return;
             }
 
-            $('.ffc-captcha-row .ffc-captcha-label-text').text(newLabel);
-            $('#ffc_captcha_hash').val(newHash);
-            $('#ffc_captcha_ans').val('').focus();
+            $form.find('.ffc-captcha-row .ffc-captcha-label-text').text(newLabel);
+            $form.find('input[name="ffc_captcha_hash"]').val(newHash);
+            $form.find('input[name="ffc_captcha_ans"]').val('').focus();
         },
 
         /**

assets/js/ffc-calendar-frontend.min.js

@@ -36,6 +36,18 @@ class MathCaptcha implements CaptchaProviderInterface {
 	 */
 	public const ID = 'math';
 
+	/**
+	 * Renders served so far in this request.
+	 *
+	 * Ids have to be unique per page and the renderer has no form context, so
+	 * the instance number comes from here. It is only ever used to build the
+	 * `<label for>` pair — no script looks these ids up, they all match by
+	 * `name` — so its value carries no meaning beyond being distinct.
+	 *
+	 * @var int
+	 */
+	private static int $instances = 0;
+
 	/**
 	 * {@inheritDoc}
 	 *
@@ -53,8 +65,12 @@ public function id(): string {
 	public function render_fields(): string {
 		$challenge = SecurityService::generate_simple_captcha();
 
-		$ffc_captcha_label = (string) $challenge['label'];
-		$ffc_captcha_token = (string) $challenge['hash'];
+		++self::$instances;
+
+		$ffc_captcha_label   = (string) $challenge['label'];
+		$ffc_captcha_token   = (string) $challenge['hash'];
+		$ffc_captcha_ans_id  = 'ffc_captcha_ans_' . self::$instances;
+		$ffc_captcha_hash_id = 'ffc_captcha_hash_' . self::$instances;
 
 		ob_start();
 		include FFC_PLUGIN_DIR . 'templates/captcha/math-fields.php';
@@ -63,6 +79,18 @@ public function render_fields(): string {
 		return false === $html ? '' : $html;
 	}
 
+	/**
+	 * Reset the per-request instance counter.
+	 *
+	 * Test seam: the counter is static, so ids would keep climbing across
+	 * test methods and assertions on a specific id would depend on run order.
+	 *
+	 * @return void
+	 */
+	public static function reset_instances(): void {
+		self::$instances = 0;
+	}
+
 	/**
 	 * {@inheritDoc}
 	 *

includes/core/captcha/class-ffc-math-captcha.php

@@ -4,21 +4,30 @@
  *
  * Extracted from the two inline copies that had drifted apart (#1053 PR2).
  *
+ * The ids carry a per-render suffix (#1056): the plugin supports several forms
+ * on one page — `DynamicFragments` has a branch dedicated to it — and fixed ids
+ * duplicated across them, which breaks the `<label for>` association a screen
+ * reader relies on to announce a required field. Nothing reads these ids
+ * programmatically: every script matches the inputs by `name`, scoped to the
+ * form. The `name` attributes are the contract with the server and never change.
+ *
  * @package FreeFormCertificate
  * @since 6.23.0
  *
- * @var string $ffc_captcha_label Challenge question, already translated.
- * @var string $ffc_captcha_token Signed, expiring challenge token.
+ * @var string $ffc_captcha_label    Challenge question, already translated.
+ * @var string $ffc_captcha_token    Signed, expiring challenge token.
+ * @var string $ffc_captcha_ans_id   Unique id for the answer input.
+ * @var string $ffc_captcha_hash_id  Unique id for the hidden token input.
  */
 
 if ( ! defined( 'ABSPATH' ) ) {
 	exit;
 }
 ?>
 <div class="ffc-captcha-row">
-	<label for="ffc_captcha_ans">
+	<label for="<?php echo esc_attr( $ffc_captcha_ans_id ); ?>">
 		<span class="ffc-captcha-label-text"><?php echo esc_html( $ffc_captcha_label ); ?></span> <span class="required">*</span>
 	</label>
-	<input type="number" name="ffc_captcha_ans" id="ffc_captcha_ans" class="ffc-input" required aria-required="true">
-	<input type="hidden" name="ffc_captcha_hash" id="ffc_captcha_hash" value="<?php echo esc_attr( $ffc_captcha_token ); ?>">
+	<input type="number" name="ffc_captcha_ans" id="<?php echo esc_attr( $ffc_captcha_ans_id ); ?>" class="ffc-input" required aria-required="true">
+	<input type="hidden" name="ffc_captcha_hash" id="<?php echo esc_attr( $ffc_captcha_hash_id ); ?>" value="<?php echo esc_attr( $ffc_captcha_token ); ?>">
 </div>

templates/captcha/math-fields.php

@@ -17,6 +17,7 @@
  *
  * @covers \FreeFormCertificate\Core\Captcha\CaptchaProvider
  * @covers \FreeFormCertificate\Core\Captcha\MathCaptcha
+ * @covers \FreeFormCertificate\Core\SecurityService
  */
 class CaptchaProviderTest extends TestCase {
 
@@ -44,8 +45,10 @@ protected function setUp(): void {
 		// a test method.
 		class_exists( '\FreeFormCertificate\Core\Captcha\CaptchaProvider' );
 		class_exists( '\FreeFormCertificate\Core\Captcha\MathCaptcha' );
+		class_exists( '\FreeFormCertificate\Core\SecurityService' );
 
 		CaptchaProvider::reset();
+		MathCaptcha::reset_instances();
 
 		$this->settings   = array();
 		$this->transients = array();
@@ -85,6 +88,7 @@ function ( string $key, $value ): bool {
 
 	protected function tearDown(): void {
 		CaptchaProvider::reset();
+		MathCaptcha::reset_instances();
 		Monkey\tearDown();
 		parent::tearDown();
 	}
@@ -143,11 +147,46 @@ public function test_math_render_fields_emits_the_challenge_inputs(): void {
 		$html = ( new MathCaptcha() )->render_fields();
 
 		$this->assertStringContainsString( 'ffc-captcha-row', $html );
-		$this->assertStringContainsString( 'ffc_captcha_ans', $html );
-		$this->assertStringContainsString( 'ffc_captcha_hash', $html );
+		$this->assertStringContainsString( 'name="ffc_captcha_ans"', $html );
+		$this->assertStringContainsString( 'name="ffc_captcha_hash"', $html );
 		$this->assertMatchesRegularExpression( '/value="\d+\.[0-9a-f]{16}\.[0-9a-f]{64}"/', $html );
 	}
 
+	public function test_math_render_fields_gives_each_instance_distinct_ids(): void {
+		// The plugin supports several forms on one page (DynamicFragments has a
+		// branch for it). Fixed ids duplicated across them and broke the
+		// `<label for>` association a screen reader needs (#1056).
+		$provider = new MathCaptcha();
+
+		$first  = $provider->render_fields();
+		$second = $provider->render_fields();
+
+		preg_match_all( '/id="(ffc_captcha_(?:ans|hash)_\d+)"/', $first . $second, $m );
+
+		$this->assertCount( 4, $m[1], 'expected two ids per render' );
+		$this->assertSame( $m[1], array_unique( $m[1] ), 'ids must not repeat across renders' );
+	}
+
+	public function test_math_render_fields_points_the_label_at_its_own_input(): void {
+		$provider = new MathCaptcha();
+		$provider->render_fields();
+		$html = $provider->render_fields();
+
+		preg_match( '/<label for="([^"]+)"/', $html, $label );
+		preg_match( '/name="ffc_captcha_ans" id="([^"]+)"/', $html, $input );
+
+		$this->assertNotEmpty( $label[1] );
+		$this->assertSame( $label[1], $input[1], 'label must reference the input in the same render' );
+	}
+
+	public function test_math_render_fields_keeps_the_name_attributes_stable(): void {
+		// The names are the contract with the server; only the ids vary.
+		$html = ( new MathCaptcha() )->render_fields();
+
+		$this->assertStringContainsString( 'name="ffc_captcha_ans"', $html );
+		$this->assertStringContainsString( 'name="ffc_captcha_hash"', $html );
+	}
+
 	public function test_math_render_fields_omits_the_honeypot(): void {
 		// The honeypot is provider-independent and belongs to the caller.
 		$this->assertStringNotContainsString( 'ffc_honeypot_trap', ( new MathCaptcha() )->render_fields() );

tests/Unit/CaptchaProviderTest.php

@@ -181,12 +181,12 @@ public function test_generate_security_fields_contains_honeypot_and_captcha(): v
 		$this->assertStringContainsString( 'ffc_captcha_ans', $html );
 		$this->assertStringContainsString( 'ffc_captcha_hash', $html );
 
-		// The hidden field carries the signed, expiring token (6.23.0). It also
-		// carries an id since PR2 unified the two drifted copies of this block
-		// on the self-scheduling variant — `ffc-calendar-frontend.js` refreshes
-		// the token through `#ffc_captcha_hash`, so the id has to stay.
+		// The hidden field carries the signed, expiring token (6.23.0). Its id
+		// is per-render since #1056 — several forms can share a page, and fixed
+		// ids duplicated across them — so match the suffix, not a literal. No
+		// script looks the id up; they all match by `name`.
 		$this->assertMatchesRegularExpression(
-			'/name="ffc_captcha_hash" id="ffc_captcha_hash" value="\d+\.[0-9a-f]{16}\.[0-9a-f]{64}"/',
+			'/name="ffc_captcha_hash" id="ffc_captcha_hash_\d+" value="\d+\.[0-9a-f]{16}\.[0-9a-f]{64}"/',
 			$html
 		);
 

tests/Unit/FrontendShortcodesTest.php

@@ -406,3 +406,87 @@ describe('ffc-calendar-frontend.js — submitBooking nonce plumbing', () => {
 		expect(payload).toContain('date=2026-05-20');
 	});
 });
+
+describe('ffc-calendar-frontend.js — refreshCaptcha scoping (#1056)', () => {
+	beforeEach(() => {
+		reset();
+		installGlobals();
+		loadScript('assets/js/ffc-calendar-frontend.js');
+	});
+
+	function mountTwoForms() {
+		// Two booking forms on one page — a configuration the plugin supports
+		// on purpose: DynamicFragments has a branch that mints a distinct
+		// challenge per form. Ids are per-instance since #1056, so the markup
+		// mirrors that: same `name`, different `id`.
+		document.body.innerHTML = `
+			<form class="ffc-booking-form" id="form-a">
+				<div class="ffc-captcha-row">
+					<label for="ffc_captcha_ans_1"><span class="ffc-captcha-label-text">1 + 1</span></label>
+					<input type="number" name="ffc_captcha_ans" id="ffc_captcha_ans_1">
+					<input type="hidden" name="ffc_captcha_hash" id="ffc_captcha_hash_1" value="token-a">
+				</div>
+			</form>
+			<form class="ffc-booking-form" id="form-b">
+				<div class="ffc-captcha-row">
+					<label for="ffc_captcha_ans_2"><span class="ffc-captcha-label-text">2 + 2</span></label>
+					<input type="number" name="ffc_captcha_ans" id="ffc_captcha_ans_2">
+					<input type="hidden" name="ffc_captcha_hash" id="ffc_captcha_hash_2" value="token-b">
+				</div>
+			</form>`;
+		return {
+			$a: window.$('#form-a'),
+			$b: window.$('#form-b'),
+		};
+	}
+
+	it('updates only the form it was given', () => {
+		const { $a, $b } = mountTwoForms();
+
+		window.ffcCalendarFrontend.refreshCaptcha($a, '9 + 9', 'token-a2');
+
+		expect($a.find('.ffc-captcha-label-text').text()).toBe('9 + 9');
+		expect($a.find('input[name="ffc_captcha_hash"]').val()).toBe('token-a2');
+
+		// The regression: the label used to be rewritten page-wide while only
+		// the first token was replaced, so this form would display a question
+		// its token did not answer.
+		expect($b.find('.ffc-captcha-label-text').text()).toBe('2 + 2');
+		expect($b.find('input[name="ffc_captcha_hash"]').val()).toBe('token-b');
+	});
+
+	it('keeps label and token coherent in the untouched form', () => {
+		const { $a, $b } = mountTwoForms();
+
+		window.ffcCalendarFrontend.refreshCaptcha($b, '7 + 7', 'token-b2');
+
+		// Each form's displayed question must belong to the token it carries.
+		expect($a.find('.ffc-captcha-label-text').text()).toBe('1 + 1');
+		expect($a.find('input[name="ffc_captcha_hash"]').val()).toBe('token-a');
+		expect($b.find('.ffc-captcha-label-text').text()).toBe('7 + 7');
+		expect($b.find('input[name="ffc_captcha_hash"]').val()).toBe('token-b2');
+	});
+
+	it('clears the answer field of the refreshed form only', () => {
+		const { $a, $b } = mountTwoForms();
+		$a.find('input[name="ffc_captcha_ans"]').val('11');
+		$b.find('input[name="ffc_captcha_ans"]').val('22');
+
+		window.ffcCalendarFrontend.refreshCaptcha($a, '3 + 3', 'token-a3');
+
+		expect($a.find('input[name="ffc_captcha_ans"]').val()).toBe('');
+		expect($b.find('input[name="ffc_captcha_ans"]').val()).toBe('22');
+	});
+
+	it('is a no-op without a form or without challenge data', () => {
+		const { $a } = mountTwoForms();
+
+		window.ffcCalendarFrontend.refreshCaptcha(null, '5 + 5', 'x');
+		window.ffcCalendarFrontend.refreshCaptcha($a, '', 'x');
+		window.ffcCalendarFrontend.refreshCaptcha($a, '5 + 5', '');
+		window.ffcCalendarFrontend.refreshCaptcha(window.$('#nope'), '5 + 5', 'x');
+
+		expect($a.find('.ffc-captcha-label-text').text()).toBe('1 + 1');
+		expect($a.find('input[name="ffc_captcha_hash"]').val()).toBe('token-a');
+	});
+});