Add Altcha captcha to notifications submissions

Gemfile

@@ -46,6 +46,8 @@ gem 'omniauth'
 gem 'omniauth-google-oauth2'
 gem 'omniauth-rails_csrf_protection'
 
+gem 'altcha-rails'
+
 gem 'pry-rails'
 
 gem 'aws-sdk-rails'

Gemfile.lock

@@ -62,6 +62,7 @@ GEM
       zeitwerk (~> 2.3)
     addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
+    altcha-rails (0.0.5)
     aws-eventstream (1.2.0)
     aws-partitions (1.734.0)
     aws-record (2.10.1)
@@ -460,6 +461,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  altcha-rails
   aws-sdk-cloudwatch
   aws-sdk-rails
   aws-sdk-s3

app/assets/javascripts/application.js

@@ -15,7 +15,6 @@
 //= require activestorage
 //= require turbolinks
 //= require cookieconsent.min
-//= require newsletter_sign_up
 //= require jscookie
 
 $(document).on("turbolinks:load", function () {

app/controllers/altcha_controller.rb

@@ -0,0 +1,5 @@
+class AltchaController < ApplicationController
+  def new
+    render json: Altcha::Challenge.create.to_json
+  end
+end

app/controllers/newsletter_subscriptions_controller.rb

@@ -0,0 +1,22 @@
+class NewsletterSubscriptionsController < ApplicationController
+
+  def subscribe
+    email, altcha = subscription_params
+    if AltchaSolution.verify_and_save(altcha)
+      SubscribeToNewsletterJob.perform_later(email, 'NewsletterSubscription')
+      respond_to do |format|
+        format.js { render :success}
+      end
+    else
+      respond_to do |format|
+        format.js { render :altcha_failure, status: :unprocessable_entity}
+      end
+    end
+  end
+
+  private
+
+  def subscription_params
+    params.require([:email, :altcha])
+  end
+end

app/controllers/notification_subscriptions_controller.rb

@@ -7,17 +7,22 @@ def index
 
   def create
     @group = NotificationSubscriptionGroup.new(notification_group_params.except(:more))
-    @group.user = current_user
-    @group.journey = Journey.find(params[:notification_subscription_group][:journey_id]) if params[:notification_subscription_group][:journey_id].present?
-
-    respond_to do |format|
-      if @group.save
-        format.html { redirect_to root_path }
-        format.js
-      else
-        format.js { render :new }
+    if AltchaSolution.verify_and_save(params.permit(:altcha)[:altcha])
+      @group.user = current_user
+      @group.journey = Journey.find(params[:notification_subscription_group][:journey_id]) if params[:notification_subscription_group][:journey_id].present?
+      respond_to do |format|
+        if @group.save
+          format.js
+        else
+          format.js { render :new }
+        end
+      end
+    else
+      respond_to do |format|
+        format.js { render :failure, status: :unprocessable_entity}
       end
     end
+
   end
 
   def confirm

app/models/altcha_solution.rb

@@ -0,0 +1,28 @@
+class AltchaSolution < ApplicationRecord
+  validates :algorithm, :challenge, :salt, :signature, :number, presence: true
+  attr_accessor :took
+
+  def self.verify_and_save(base64encoded)
+    p = JSON.parse(Base64.decode64(base64encoded)) rescue nil
+    return false if p.nil?
+
+    submission = Altcha::Submission.new(p)
+    return false unless submission.valid?
+
+    solution = self.new(p)
+
+    begin
+      return solution.save
+    rescue ActiveRecord::RecordNotUnique
+      # Replay attack
+      return false
+    end
+  end
+
+  def self.cleanup
+    # Replay attacks are protected by the time stamp in the salt of the challenge for
+    # the duration configured in the timeout. All solutions in the database that older
+    # can be deleted.
+    AltchaSolution.where('created_at < ?', Time.now - Altcha.timeout).delete_all
+  end
+end

app/views/components/_footer.html.erb

@@ -5,7 +5,7 @@
         <span class="sdn-footer__newsletter-heading"><label for="email-input">Novinky emailom</label> <small class="sdn-footer__newsletter-heading-tooltip">(raz mesačne)</small></span>
         <div id="newsletter-success" style="display: none">
           <p style="color: white;">
-            <strong>Na Váš e-mail sme poslali potvrdzovaciu správu.</strong>
+            <strong>Na Váš e-mail sme poslali potvrdzovaciu správu. Ak nechodí, skúste to znova.</strong>
             <br>
             Ďakujeme za Váš záujem.
           </p>
@@ -15,16 +15,7 @@
             <strong></strong>
           </p>
         </div>
-        <form id="newsletter-form" role="form" action="https://my.sendinblue.com/users/subscribe/js_id/29wti/id/4" data-action="https://my.sendinblue.com/users/subscribeembed/js_id/29wti/id/4" method="post">
-          <div class="govuk-form-group sdn-footer__newsletter-form-group">
-            <input type="hidden" name="js_id" id="js_id" value="29wti">
-            <input type="hidden" name="listid" id="listid" value="45">
-            <input type="hidden" name="from_url" id="from_url" value="yes">
-            <input type="hidden" name="hdn_email_txt" id="hdn_email_txt" value="">
-            <input type="email" name="email" id="email-input" required class="govuk-input sdn-footer__newsletter-input" autocomplete="email" placeholder="Zadajte emailovú adresu"/>
-            <button type="submit" class="govuk-button sdn-footer__newsletter-button">Prihlásiť</button>
-          </div>
-        </form>
+        <%= render 'newsletter_subscriptions/form' %>
         <span class="sdn-footer__newsletter-disclaimer">
                 Prihlásením dávam dobrovoľný súhlas OZ Slovensko.Digital na zasielanie bezplatného newslettera na mnou zadaný e-mail. Tento súhlas môžem kdykoľvek odvolať na <%= mail_to ENV['DEFAULT_EMAIL_FROM'], ENV['DEFAULT_EMAIL_FROM'], class: 'sdn-footer__link' %>. Oboznámil(a) som sa s informáciami v sekcii <%= link_to 'Ochrana osobných údajov', page_path('ochrana-osobnych-udajov'), class: 'sdn-footer__link' %>.</span>
       </div>

app/views/layouts/application.html.erb

@@ -21,6 +21,7 @@
   <%= stylesheet_link_tag 'application', media: 'all', 'data-turbolinks-track': 'reload' %>
   <%= javascript_include_tag 'application', 'data-turbolinks-track': 'reload' %>
   <script defer data-domain="navody.digital" src="https://plausible.io/js/plausible.js"></script>
+  <script async defer src="https://cdn.jsdelivr.net/gh/altcha-org/altcha@main/dist/altcha.min.js" type="module"></script>
 </head>
 
 <body class="govuk-template__body">

app/views/newsletter_subscriptions/_form.html.erb

@@ -0,0 +1,6 @@
+<%= form_tag newsletter_subscribe_path, method: :post, remote: true, id: "newsletter-form" do |f| %>
+  <%= email_field_tag :email, '',   class: 'govuk-input sdn-footer__newsletter-input', placeholder: "Zadajte emailovú adresu", autocomplete: :email %>
+  <%= submit_tag 'Prihlásiť', class: 'govuk-button sdn-footer__newsletter-button' %>
+  <altcha-widget hidelogo hidefooter strings="<%= JSON.dump({ 'label': 'Nie som robot', 'verifying': 'Overujem...', 'verified': 'Overené'}) %>" challengeurl="<%= altcha_url() %>"></altcha-widget>
+  <div class="newsletter-altcha-error"></div>
+<% end %>

app/views/newsletter_subscriptions/failure.js.erb

@@ -0,0 +1,2 @@
+$('#newsletter-form').replaceWith('<%=j render partial: 'newsletter_subscriptions/form', object: @group %>');
+$('.newsletter-altcha-error').html('Nie sme si isti, či nie ste robot... zaškrtli ste, že nie ste?');

app/views/newsletter_subscriptions/success.js.erb

@@ -0,0 +1,4 @@
+$('#newsletter-success').show();
+if ($('#newsletter-warning').is(':visible')) {
+  $('#newsletter-warning').hide();
+}

app/views/notification_subscriptions/_form.html.erb

@@ -43,6 +43,8 @@
     <% if !form.journey.nil? and form.journey.blank? %>
       <%= hidden_field_tag 'notification_subscription_group[journey_id]', form.journey.id %>
     <% end %>
+    <altcha-widget hidelogo hidefooter strings="<%= JSON.dump({ 'label': 'Nie som robot', 'verifying': 'Overujem...', 'verified': 'Overené'}) %>" challengeurl="<%= altcha_url() %>"></altcha-widget>
+    <div class="altcha-error"></div>
     <%= submit_tag 'Chcem dostávať tieto notifikácie', class: 'govuk-button' %>
   </div>
 

app/views/notification_subscriptions/failure.js.erb

@@ -0,0 +1,2 @@
+$('#new_subscription_notification_group').replaceWith('<%=j render partial: 'form', object: @group %>');
+$('.altcha-error').html('Nie sme si isti, či nie ste robot... zaškrtli ste, že nie ste?');

config/initializers/altcha.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+Altcha.setup do |config|
+  config.algorithm = 'SHA-256'
+  config.num_range = (50_000..51_000)
+  config.timeout = 5.minutes
+  config.hmac_key = 'dfa06d467a84fea13941f1c52c38c6458a67617a'
+end

config/routes.rb

@@ -1,5 +1,6 @@
 Rails.application.routes.draw do
 
+  get '/altcha', to: 'altcha#new'
   get :health, to: 'health#index'
   get 'robots.:format', to: 'robots#index'
 
@@ -166,6 +167,8 @@
     get :confirm, on: :member, path: 'potvrdit'
   end
 
+  post 'newsletter/subscribe', to: 'newsletter_subscriptions#subscribe', as: :newsletter_subscribe
+
   resource :session, only: [:new, :create, :destroy]
   get '/auth/magiclink/info', to: 'sessions#magic_link_info'
   get '/auth/failure', to: 'sessions#failure'

db/migrate/20240427082705_create_altcha_solutions.rb

@@ -0,0 +1,15 @@
+class CreateAltchaSolutions < ActiveRecord::Migration[6.1]
+  def change
+    create_table(:altcha_solutions) do |t|
+      t.string :algorithm
+      t.string :challenge
+      t.string :salt
+      t.string :signature
+      t.integer :number
+
+      t.timestamps
+    end
+
+    add_index :altcha_solutions, [ :algorithm, :challenge, :salt, :signature, :number ], unique: true, name: 'index_altcha_solutions'
+  end
+end

db/structure.sql

@@ -467,6 +467,41 @@ CREATE SEQUENCE public.active_storage_variant_records_id_seq
 ALTER SEQUENCE public.active_storage_variant_records_id_seq OWNED BY public.active_storage_variant_records.id;
 
 
+--
+-- Name: altcha_solutions; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public.altcha_solutions (
+    id bigint NOT NULL,
+    algorithm character varying,
+    challenge character varying,
+    salt character varying,
+    signature character varying,
+    number integer,
+    created_at timestamp(6) without time zone NOT NULL,
+    updated_at timestamp(6) without time zone NOT NULL
+);
+
+
+--
+-- Name: altcha_solutions_id_seq; Type: SEQUENCE; Schema: public; Owner: -
+--
+
+CREATE SEQUENCE public.altcha_solutions_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+
+--
+-- Name: altcha_solutions_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: -
+--
+
+ALTER SEQUENCE public.altcha_solutions_id_seq OWNED BY public.altcha_solutions.id;
+
+
 --
 -- Name: apps; Type: TABLE; Schema: public; Owner: -
 --
@@ -1647,6 +1682,14 @@ ALTER TABLE ONLY public.active_storage_variant_records
     ADD CONSTRAINT active_storage_variant_records_pkey PRIMARY KEY (id);
 
 
+--
+-- Name: altcha_solutions altcha_solutions_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public.altcha_solutions
+    ADD CONSTRAINT altcha_solutions_pkey PRIMARY KEY (id);
+
+
 --
 -- Name: apps apps_pkey; Type: CONSTRAINT; Schema: public; Owner: -
 --
@@ -1899,6 +1942,13 @@ CREATE UNIQUE INDEX index_active_storage_blobs_on_key ON public.active_storage_b
 CREATE UNIQUE INDEX index_active_storage_variant_records_uniqueness ON public.active_storage_variant_records USING btree (blob_id, variation_digest);
 
 
+--
+-- Name: index_altcha_solutions; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE UNIQUE INDEX index_altcha_solutions ON public.altcha_solutions USING btree (algorithm, challenge, salt, signature, number);
+
+
 --
 -- Name: index_categories_categorizations; Type: INDEX; Schema: public; Owner: -
 --
@@ -2440,6 +2490,7 @@ INSERT INTO "schema_migrations" (version) VALUES
 ('20230325092744'),
 ('20230325095737'),
 ('20230325151049'),
+('20240427082705'),
 ('20240427124856');