diff --git a/app/forms/recaptcha_form.rb b/app/forms/recaptcha_form.rb index 4d49437d65b..1ddd6fa9ee9 100644 --- a/app/forms/recaptcha_form.rb +++ b/app/forms/recaptcha_form.rb @@ -6,6 +6,7 @@ class RecaptchaForm VERIFICATION_ENDPOINT = 'https://www.google.com/recaptcha/api/siteverify' RESULT_ERRORS = ['missing-input-secret', 'invalid-input-secret'].freeze + EXEMPT_RESULT_REASONS = ['LOW_CONFIDENCE_SCORE'].freeze attr_reader :recaptcha_action, :recaptcha_token, @@ -95,6 +96,7 @@ def faraday def recaptcha_result_valid?(result) return true if result.blank? + return true if result_reason_exempt?(result) if result.success? result.score >= score_threshold @@ -107,6 +109,10 @@ def is_result_error?(error_code) RESULT_ERRORS.include?(error_code) end + def result_reason_exempt?(result) + (EXEMPT_RESULT_REASONS & result.reasons).any? + end + def log_analytics(result: nil, error: nil) analytics&.recaptcha_verify_result_received( recaptcha_result: result.to_h.presence, diff --git a/spec/forms/recaptcha_enterprise_form_spec.rb b/spec/forms/recaptcha_enterprise_form_spec.rb index 2e32736c455..1d9858d8b2e 100644 --- a/spec/forms/recaptcha_enterprise_form_spec.rb +++ b/spec/forms/recaptcha_enterprise_form_spec.rb @@ -270,6 +270,46 @@ form_class: 'RecaptchaEnterpriseForm', ) end + + context 'with low confidence score as one of the reasons for failure' do + before do + stub_recaptcha_response( + body: { + tokenProperties: { valid: true, action: }, + riskAnalysis: { score:, reasons: ['LOW_CONFIDENCE_SCORE'] }, + event: {}, + name:, + }, + action:, + token:, + ) + end + + it 'is successful with assessment id' do + response, assessment_id = result + + expect(response.to_h).to eq(success: true) + expect(assessment_id).to eq(name) + end + + it 'logs analytics of the body' do + result + + expect(analytics).to have_logged_event( + 'reCAPTCHA verify result received', + recaptcha_result: { + success: true, + score:, + reasons: ['LOW_CONFIDENCE_SCORE'], + errors: [], + assessment_id: name, + }, + evaluated_as_valid: true, + score_threshold: score_threshold, + form_class: 'RecaptchaEnterpriseForm', + ) + end + end end context 'with successful score from validation service' do