WIP for #884

Author: oharsta

account-gui/package.json

@@ -38,6 +38,7 @@
     "test:watch": "npm run test -- --watch"
   },
   "dependencies": {
+    "@friendlycaptcha/sdk": "^0.1.24",
     "@github/webauthn-json": "^2.1.1",
     "dompurify": "^3.2.6",
     "i18n-js": "^4.5.1",

account-gui/src/api/index.js

@@ -41,8 +41,8 @@ function postPutJson(path, body, method) {
 }
 
 //Base
-export function generateCodeNewUser(email, givenName, familyName, authenticationRequestId) {
-    const body = {user: {email, givenName, familyName}, authenticationRequestId};
+export function generateCodeNewUser(email, givenName, familyName, authenticationRequestId, captchaResponse) {
+    const body = {user: {email, givenName, familyName}, authenticationRequestId, captchaResponse};
     return postPutJson("/myconext/api/idp/generate_code_request", body, "POST");
 }
 

account-gui/src/locale/en.js

@@ -1,4 +1,4 @@
-const en =  {
+const en = {
     login: {
         requestEduId: "No eduID?",
         requestEduId2: "Create one!",
@@ -429,6 +429,9 @@ const en =  {
             studielink: "Studielink",
             servicedesk: "Service Desk"
         }
+    },
+    captcha: {
+        proveNotRobot: "Please tick the 'I am human' checkbox"
     }
 };
 export default en;

account-gui/src/locale/nl.js

@@ -428,6 +428,9 @@ const nl = {
             studielink: "Studielink",
             servicedesk: "Service Desk"
         }
+    },
+    captcha: {
+        proveNotRobot: "Check de 'I am human' checkbox"
     }
 };
 export default nl;

account-gui/src/routes/Request.svelte

@@ -6,7 +6,7 @@
     import I18n from "../locale/I18n";
     import critical from "../icons/critical.svg?raw";
     import attention from "../icons/alert-circle.svg?raw";
-
+    import {FriendlyCaptchaSDK} from "@friendlycaptcha/sdk"
     import {fetchServiceName, generateCodeNewUser} from "../api/index";
     import CheckBox from "../components/CheckBox.svelte";
     import Spinner from "../components/Spinner.svelte";
@@ -15,22 +15,39 @@
     import {domains} from "../stores/domains";
     import Cookies from "js-cookie";
     import {cookieNames} from "../constants/cookieNames";
+    import {isEmpty} from "../utils/utils.js";
 
     export let id;
+
     let emailInUse = false;
     let emailForbidden = false;
     let initial = true;
     let showSpinner = true;
     let serviceName = "";
-
     let agreedWithTerms = false;
+    let captchaShowWarning = false;
 
     onMount(() => {
         $links.displayBackArrow = true;
         $user.givenName = "";
         $user.familyName = "";
         $user.knowUser = null;
         Cookies.remove(cookieNames.USERNAME);
+        if ($conf.captchaEnabled) {
+            const mount = document.querySelector("#captcha");
+            mount.addEventListener("frc:widget.complete", function(event) {
+                captchaShowWarning = false;
+            });
+
+            const sdk = new FriendlyCaptchaSDK();
+            sdk.createWidget({
+                element: mount,
+                sitekey: $conf.captchaSiteKey,
+                startMode: "auto",
+                language: I18n.locale,
+            });
+        }
+
         fetchServiceName(id).then(res => {
             serviceName = res.name;
             showSpinner = false;
@@ -39,8 +56,13 @@
 
     const handleNext = () => {
         if (allowedNext($user.email, $user.givenName, $user.familyName, agreedWithTerms)) {
+            const captchaResponse = document.querySelector("[name='frc-captcha-response']").value;
+            if ($conf.captchaEnabled && isEmpty(captchaResponse) || captchaResponse === ".ACTIVATED") {
+                captchaShowWarning = true;
+                return;
+            }
             showSpinner = true;
-            generateCodeNewUser($user.email, $user.givenName, $user.familyName, id)
+            generateCodeNewUser($user.email, $user.givenName, $user.familyName, id, captchaResponse)
                 .then(res => {
                     const url = res.stepup ? `/stepup/${id}?name=${encodeURIComponent(serviceName)}&explanation=${res.explanation}` :
                         `/code/${id}?name=${encodeURIComponent(serviceName)}&modus=cr`;
@@ -72,7 +94,7 @@
     }
 
     const allowedNext = (email, familyName, givenName, agreedWithTerms) => {
-        return validEmail(email) && familyName && givenName && agreedWithTerms && !$domains.allowedDomainNamesError
+        return validEmail(email) && familyName && givenName && agreedWithTerms && !$domains.allowedDomainNamesError && !captchaShowWarning
     };
 
     const handleEmailBlur = e => {
@@ -186,11 +208,28 @@
         font-weight: 600;
     }
 
+    .controls {
+        margin: 10px 0 10px 0;
+        display: flex;
+        flex-direction: column;
+        gap: 10px
+    }
+
+    #captcha {
+        width: 335px !important;
+        margin-top: 15px;
+    }
+
+    :global(.frc-banner) {
+        display: none;
+    }
+
+
 </style>
 {#if showSpinner}
     <Spinner/>
 {/if}
-
+<form on:keydown={(e) => e.key === 'Enter' && e.preventDefault()}>
 <h2 class="header">{I18n.t("LinkFromInstitution.RequestEduIdButton.COPY")}</h2>
 {#if serviceName}
     <h2 class="top">{I18n.t("Login.HeaderSubTitle.COPY")}<span>{serviceName}</span></h2>
@@ -207,7 +246,8 @@
        value={$user.email}
        on:blur={handleEmailBlur}>
 {#if !initial && !validEmail($user.email)}
-    <div class="error"><span class="svg">{@html critical}</span><span>{I18n.t("LinkFromInstitution.InvalidEmail.COPY")}</span></div>
+    <div class="error"><span
+            class="svg">{@html critical}</span><span>{I18n.t("LinkFromInstitution.InvalidEmail.COPY")}</span></div>
 {/if}
 {#if emailInUse}
     <div class="error">
@@ -274,12 +314,19 @@
 {#if !initial && !$user.familyName}
     <span class="error">{I18n.t("Login.RequiredAttribute.COPY", {attr: I18n.t("Profile.LastName.COPY")})}</span>
 {/if}
-<CheckBox value={agreedWithTerms}
-          className="light"
-          label={I18n.t("LinkFromInstitution.AgreeWithTerms.COPY")}
-          onChange={val => agreedWithTerms = val}/>
-<Button disabled={showSpinner || !allowedNext($user.email, $user.familyName, $user.givenName, agreedWithTerms)}
-        href="/magic"
-        className="full"
-        label={I18n.t("LinkFromInstitution.RequestEduIdButton.COPY")}
-        onClick={handleNext}/>
+<div class="controls">
+    <CheckBox value={agreedWithTerms}
+              className="light"
+              label={I18n.t("LinkFromInstitution.AgreeWithTerms.COPY")}
+              onChange={val => agreedWithTerms = val}/>
+    <div id="captcha"></div>
+    {#if captchaShowWarning}
+        <span class="captcha error">{I18n.t("captcha.proveNotRobot")}</span>
+    {/if}
+    <Button disabled={showSpinner || !allowedNext($user.email, $user.familyName, $user.givenName, agreedWithTerms)}
+            href="/magic"
+            className="full"
+            label={I18n.t("LinkFromInstitution.RequestEduIdButton.COPY")}
+            onClick={handleNext}/>
+</div>
+</form>

account-gui/src/stores/conf.js

@@ -13,7 +13,9 @@ export const conf = writable({
     featureIdVerify: false,
     featureServiceDeskActive: false,
     emailSpamThresholdSeconds: 5,
-    mobileAppRedirect: ""
+    mobileAppRedirect: "",
+    captchaEnabled: false,
+    captchaSiteKey: null
 });
 
 export const links = writable({

account-gui/yarn.lock

@@ -1034,6 +1034,11 @@
   resolved "https://registry.yarnpkg.com/@esbuild/win32-x64/-/win32-x64-0.25.5.tgz#7fc114af5f6563f19f73324b5d5ff36ece0803d1"
   integrity sha512-TXv6YnJ8ZMVdX+SXWVBo/0p8LTcrUYngpWjvm91TMjjBQii7Oz11Lw5lbDV5Y0TzuhSJHwiH4hEtC1I42mMS0g==
 
+"@friendlycaptcha/sdk@^0.1.24":
+  version "0.1.24"
+  resolved "https://registry.yarnpkg.com/@friendlycaptcha/sdk/-/sdk-0.1.24.tgz#b252e00f38488847a2f81c94d8294809e0fcc577"
+  integrity sha512-cGsY/Q6dl9pDQVRv1iSZmAOAls0mVcN6YETRx0Y+w/uUD9sOlPNg+oMFzgzkkVvH6+Sc4Oradv10UVr8ftNBtQ==
+
 "@github/webauthn-json@^2.1.1":
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/@github/webauthn-json/-/webauthn-json-2.1.1.tgz#648e63fc28050917d2882cc2b27817a88cb420fc"

myconext-server/src/main/java/myconext/api/LoginController.java

@@ -67,6 +67,8 @@ public LoginController(UserRepository userRepository,
                            @Value("${oidc-token-api.enabled}") boolean featureOidcTokenAPI,
                            @Value("${feature.create_eduid_institution_enabled}") boolean createEduIDInstitutionEnabled,
                            @Value("${feature.create_eduid_institution_landing}") boolean createEduIDInstitutionLanding,
+                           @Value("${feature.captcha_enabled}") boolean captchaEnabled,
+                           @Value("${captcha.sitekey}") String captchaSiteKey,
                            @Value("${email_spam_threshold_seconds}") long emailSpamThresholdSeconds,
                            @Value("${linked_accounts.expiry-duration-days-non-validated}") long expirationNonValidatedDurationDays,
                            @Value("${mobile_app_redirect}") String mobileAppRedirect,
@@ -97,6 +99,8 @@ public LoginController(UserRepository userRepository,
         this.config.put("mobileAppRedirect", mobileAppRedirect);
         this.config.put("featureIdVerify", idVerify);
         this.config.put("featureServiceDeskActive", serviceDeskActive);
+        this.config.put("captchaEnabled", captchaEnabled);
+        this.config.put("captchaSiteKey", captchaSiteKey);
         this.secureCookie = secureCookie;
         this.userRepository = userRepository;
         this.authenticationRequestRepository = authenticationRequestRepository;

myconext-server/src/main/java/myconext/api/UserController.java

@@ -23,6 +23,7 @@
 import jakarta.validation.Valid;
 import lombok.Getter;
 import lombok.SneakyThrows;
+import myconext.captcha.CaptchaVerifier;
 import myconext.cron.DisposableEmailProviders;
 import myconext.exceptions.*;
 import myconext.mail.MailBox;
@@ -104,7 +105,7 @@ public class UserController implements UserAuthentication {
     private final boolean featureDefaultRememberMe;
     private final boolean sendJsExceptions;
     private final ServicesConfiguration servicesConfiguration;
-
+    private final CaptchaVerifier captchaVerifier;
     private final List<VerifyIssuer> issuers;
     //For now, hardcode the not known issuers from test
     private final List<String> unknownIssuers = List.of("CURRNL2A");
@@ -122,6 +123,7 @@ public UserController(UserRepository userRepository,
                           EmailDomainGuard emailDomainGuard,
                           DisposableEmailProviders disposableEmailProviders,
                           RegistrationRepository registrationRepository,
+                          CaptchaVerifier captchaVerifier,
                           @Qualifier("jsonMapper") ObjectMapper objectMapper,
                           @Value("${email.magic-link-url}") String magicLinkUrl,
                           @Value("${schac_home_organization}") String schacHomeOrganization,
@@ -148,6 +150,7 @@ public UserController(UserRepository userRepository,
         this.disposableEmailProviders = disposableEmailProviders;
         this.registrationRepository = registrationRepository;
         this.objectMapper = objectMapper;
+        this.captchaVerifier = captchaVerifier;
         this.magicLinkUrl = magicLinkUrl;
         this.schacHomeOrganization = schacHomeOrganization;
         this.idpBaseUrl = idpBaseUrl;
@@ -282,8 +285,12 @@ public ResponseEntity generateCodeRequestNewUser(@Valid @RequestBody ClientAuthe
                 .orElseThrow(() -> new ExpiredAuthenticationException("Expired authentication request"));
 
         User user = clientAuthenticationRequest.getUser();
-
         String email = user.getEmail();
+
+        boolean success = this.captchaVerifier.verify(clientAuthenticationRequest.getCaptchaResponse());
+        if (!success) {
+            throw new CaptchInvalidException("Invalid captcha for user: " + email);
+        }
         verifyEmails(email, true);
 
         Optional<User> optionalUser = userRepository.findUserByEmail(emailGuessingPreventor.sanitizeEmail(email));

myconext-server/src/main/java/myconext/captcha/ApiHeaderInterceptor.java

@@ -0,0 +1,28 @@
+package myconext.captcha;
+
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpRequest;
+import org.springframework.http.client.ClientHttpRequestExecution;
+import org.springframework.http.client.ClientHttpRequestInterceptor;
+import org.springframework.http.client.ClientHttpResponse;
+
+import java.io.IOException;
+
+public class ApiHeaderInterceptor implements ClientHttpRequestInterceptor {
+
+    private final String apiKey;
+
+    public ApiHeaderInterceptor(String apiKey) {
+        this.apiKey = apiKey;
+    }
+
+    @Override
+    public ClientHttpResponse intercept(HttpRequest request,
+                                        byte[] body,
+                                        ClientHttpRequestExecution execution) throws IOException {
+
+        HttpHeaders headers = request.getHeaders();
+        headers.set("X-API-Key", this.apiKey);
+        return execution.execute(request, body);
+    }
+}