Log Arkose challenge events (!155201) · Merge requests · GitLab.org / GitLab

Eugie Limpin requested to merge el-log-arkose-challenge-events into master Jun 04, 2024

What does this MR do and why?

Log when:

Interactive or transparent challenge is solved in signup form
Interactive challenge is solved before Identity Verification phone number or credit card verification step

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Sample log after solving interactive challenge in signup form

{
  "severity": "INFO",
  "time": "2024-06-05T02:45:51.339Z",
  "correlation_id": "01HZK4KP0JXPCM1Y4QSS4NGKDA",
  "meta.caller_id": "RegistrationsController#create",
  "meta.remote_ip": "127.0.0.1",
  "meta.feature_category": "instance_resiliency",
  "meta.client_id": "ip/127.0.0.1",
  "username": "jun2451045",
  "message": "Arkose challenge",
  "event": "interactive challenge solved"
}

Sample log after solving interactive challenge before phone number verification code send

{
  "severity": "INFO",
  "time": "2024-06-05T02:50:05.965Z",
  "correlation_id": "01HZK4VFBKP2361DEQX0T0JSXT",
  "meta.caller_id": "Users::RegistrationsIdentityVerificationController#send_phone_verification_code",
  "meta.remote_ip": "127.0.0.1",
  "meta.feature_category": "instance_resiliency",
  "meta.client_id": "ip/127.0.0.1",
  "username": "jun2451045",
  "message": "Arkose challenge",
  "event": "interactive challenge solved"
}

How to set up and validate locally

Start GDK simulating SaaS

$ export GITLAB_SIMULATE_SAAS=1
$ gdk start

Enable FFs

$ rails c
> Feature.enable(:identity_verification)
> Feature.enable(:identity_verification_phone_number)
> Feature.enable(:identity_verification_arkose_challenge)

Setup Telesign

$ rails c
> ApplicationSetting.first.update(telesign_customer_xid: '<value_is_in_1Pass>', telesign_api_key: '<value_is_in_1Pass>')

Credentials are in 1Password under Telesign API Keys (use GITLAB - DEVELOPMENT)

Setup Arkose

> ApplicationSetting.first.update(arkose_labs_public_api_key: "XXX", arkose_labs_private_api_key: "YYY", )
> ApplicationSetting.first.update(arkose_labs_data_exchange_key: "ZZZ")

Note: credentials are in 1Password under ArkoseLabs API keys (DEVELOPMENT)

Update ee/app/helpers/ee/registrations_helper.rb so that an Arkose challenge is shown and required before a user can be created

diff --git a/ee/app/helpers/ee/registrations_helper.rb b/ee/app/helpers/ee/registrations_helper.rb
index d784a60b791cf..10b8a9486b3a3 100644
--- a/ee/app/helpers/ee/registrations_helper.rb
+++ b/ee/app/helpers/ee/registrations_helper.rb
@@ -51,7 +51,7 @@ def registration_objective_options
     def signup_arkose_data_exchange_payload
       use_case = Arkose::DataExchangePayload::USE_CASE_SIGN_UP
       show_challenge =
-        PhoneVerification::Users::RateLimitService.daily_transaction_hard_limit_exceeded?
+        PhoneVerification::Users::RateLimitService.daily_transaction_hard_limit_exceeded? || true
 
       Arkose::DataExchangePayload.new(
         request,

Tail logs
```
tail -f log/application_json.log
```
Go to http://localhost:3000/users/sign_up, fill in the signup form, solve the Arkose challenge, and then click Register

Verify that a log similar to the following is recorded

{
  "severity": "INFO",
  "time": "2024-06-05T02:45:51.339Z",
  "correlation_id": "01HZK4KP0JXPCM1Y4QSS4NGKDA",
  "meta.caller_id": "RegistrationsController#create",
  "meta.remote_ip": "127.0.0.1",
  "meta.feature_category": "instance_resiliency",
  "meta.client_id": "ip/127.0.0.1",
  "username": "jun2451045",
  "message": "Arkose challenge",
  "event": "interactive challenge solved"
}

Set the new user's Arkose risk score to 'Medium'. This will require the user to verify their email, and phone number.
```
$ rails c
> User.last.custom_attributes.find_by_key('arkose_risk_band').update(value: 'Medium')
```
Update the user's confirmed_at in Rails console. This marks them as email-verified and move them on to phone number verification step
```
$ rails c
> User.last.update(confirmed_at: Time.now)
```
Open an incognito browser tab and login with the user again
Verify that Arkose challenge is shown on the phone number verification step
Enter a phone number, solve the challenge, and click Send code