From b0667b258bc64673d3164b6eccc1f1b70ce25fe4 Mon Sep 17 00:00:00 2001
From: Ehren Kret <ehren@signal.org>
Date: Fri, 30 Jul 2021 15:04:16 -0700
Subject: [PATCH] Implement EnterpriseRecaptchaClient

---
 .../WhisperServerConfiguration.java           | 14 +++++-
 .../textsecuregcm/WhisperServerService.java   |  6 ++-
 .../RecaptchaV2Configuration.java             | 42 ++++++++++++++++++
 .../recaptcha/EnterpriseRecaptchaClient.java  | 44 ++++++++++++++++++-
 4 files changed, 102 insertions(+), 4 deletions(-)
 create mode 100644 service/src/main/java/org/whispersystems/textsecuregcm/configuration/RecaptchaV2Configuration.java

diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerConfiguration.java b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerConfiguration.java
index 4f5a671c7..9ae4ddd29 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerConfiguration.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerConfiguration.java
@@ -31,22 +31,23 @@ import org.whispersystems.textsecuregcm.configuration.GcpAttachmentsConfiguratio
 import org.whispersystems.textsecuregcm.configuration.MaxDeviceConfiguration;
 import org.whispersystems.textsecuregcm.configuration.MessageCacheConfiguration;
 import org.whispersystems.textsecuregcm.configuration.MessageDynamoDbConfiguration;
-import org.whispersystems.textsecuregcm.configuration.WavefrontConfiguration;
+import org.whispersystems.textsecuregcm.configuration.MonitoredS3ObjectConfiguration;
 import org.whispersystems.textsecuregcm.configuration.PaymentsServiceConfiguration;
 import org.whispersystems.textsecuregcm.configuration.PushConfiguration;
 import org.whispersystems.textsecuregcm.configuration.RateLimitsConfiguration;
 import org.whispersystems.textsecuregcm.configuration.RecaptchaConfiguration;
+import org.whispersystems.textsecuregcm.configuration.RecaptchaV2Configuration;
 import org.whispersystems.textsecuregcm.configuration.RedisClusterConfiguration;
 import org.whispersystems.textsecuregcm.configuration.RedisConfiguration;
 import org.whispersystems.textsecuregcm.configuration.RemoteConfigConfiguration;
 import org.whispersystems.textsecuregcm.configuration.SecureBackupServiceConfiguration;
 import org.whispersystems.textsecuregcm.configuration.SecureStorageServiceConfiguration;
 import org.whispersystems.textsecuregcm.configuration.TestDeviceConfiguration;
-import org.whispersystems.textsecuregcm.configuration.MonitoredS3ObjectConfiguration;
 import org.whispersystems.textsecuregcm.configuration.TurnConfiguration;
 import org.whispersystems.textsecuregcm.configuration.TwilioConfiguration;
 import org.whispersystems.textsecuregcm.configuration.UnidentifiedDeliveryConfiguration;
 import org.whispersystems.textsecuregcm.configuration.VoiceVerificationConfiguration;
+import org.whispersystems.textsecuregcm.configuration.WavefrontConfiguration;
 import org.whispersystems.textsecuregcm.configuration.ZkConfig;
 import org.whispersystems.websocket.configuration.WebSocketConfiguration;
 
@@ -253,6 +254,11 @@ public class WhisperServerConfiguration extends Configuration {
   @JsonProperty
   private RecaptchaConfiguration recaptcha;
 
+  @Valid
+  @NotNull
+  @JsonProperty
+  private RecaptchaV2Configuration recaptchaV2;
+
   @Valid
   @NotNull
   @JsonProperty
@@ -304,6 +310,10 @@ public class WhisperServerConfiguration extends Configuration {
     return recaptcha;
   }
 
+  public RecaptchaV2Configuration getRecaptchaV2Configuration() {
+    return recaptchaV2;
+  }
+
   public VoiceVerificationConfiguration getVoiceVerificationConfiguration() {
     return voiceVerification;
   }
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
index 75bcc2561..c19354acb 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
@@ -469,7 +469,11 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
     ReceiptSender            receiptSender      = new ReceiptSender(accountsManager, messageSender);
     TurnTokenGenerator       turnTokenGenerator = new TurnTokenGenerator(config.getTurnConfiguration());
     LegacyRecaptchaClient legacyRecaptchaClient = new LegacyRecaptchaClient(config.getRecaptchaConfiguration().getSecret());
-    EnterpriseRecaptchaClient enterpriseRecaptchaClient = new EnterpriseRecaptchaClient();
+    EnterpriseRecaptchaClient enterpriseRecaptchaClient = new EnterpriseRecaptchaClient(
+        config.getRecaptchaV2Configuration().getScoreFloor().doubleValue(),
+        config.getRecaptchaV2Configuration().getSiteKey(),
+        config.getRecaptchaV2Configuration().getProjectPath(),
+        config.getRecaptchaV2Configuration().getCredentialConfigurationJson());
     TransitionalRecaptchaClient transitionalRecaptchaClient = new TransitionalRecaptchaClient(legacyRecaptchaClient, enterpriseRecaptchaClient);
     PushChallengeManager     pushChallengeManager = new PushChallengeManager(apnSender, gcmSender, pushChallengeDynamoDb);
     RateLimitChallengeManager rateLimitChallengeManager = new RateLimitChallengeManager(pushChallengeManager,
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/RecaptchaV2Configuration.java b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/RecaptchaV2Configuration.java
new file mode 100644
index 000000000..48128fdcf
--- /dev/null
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/RecaptchaV2Configuration.java
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2021 Signal Messenger, LLC
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+package org.whispersystems.textsecuregcm.configuration;
+
+import java.math.BigDecimal;
+import javax.validation.constraints.DecimalMax;
+import javax.validation.constraints.DecimalMin;
+import javax.validation.constraints.NotEmpty;
+import javax.validation.constraints.NotNull;
+
+public class RecaptchaV2Configuration {
+
+  private BigDecimal scoreFloor;
+  private String projectPath;
+  private String siteKey;
+  private String credentialConfigurationJson;
+
+  @DecimalMin("0")
+  @DecimalMax("1")
+  @NotNull
+  public BigDecimal getScoreFloor() {
+    return scoreFloor;
+  }
+
+  @NotEmpty
+  public String getProjectPath() {
+    return projectPath;
+  }
+
+  @NotEmpty
+  public String getSiteKey() {
+    return siteKey;
+  }
+
+  @NotEmpty
+  public String getCredentialConfigurationJson() {
+    return credentialConfigurationJson;
+  }
+}
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/recaptcha/EnterpriseRecaptchaClient.java b/service/src/main/java/org/whispersystems/textsecuregcm/recaptcha/EnterpriseRecaptchaClient.java
index 3dde2192e..32a09fa0f 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/recaptcha/EnterpriseRecaptchaClient.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/recaptcha/EnterpriseRecaptchaClient.java
@@ -5,14 +5,56 @@
 
 package org.whispersystems.textsecuregcm.recaptcha;
 
+import com.google.api.gax.core.FixedCredentialsProvider;
+import com.google.auth.oauth2.GoogleCredentials;
+import com.google.cloud.recaptchaenterprise.v1.RecaptchaEnterpriseServiceClient;
+import com.google.cloud.recaptchaenterprise.v1.RecaptchaEnterpriseServiceSettings;
+import com.google.recaptchaenterprise.v1.Assessment;
+import com.google.recaptchaenterprise.v1.Event;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Objects;
+import javax.annotation.Nonnull;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 public class EnterpriseRecaptchaClient implements RecaptchaClient {
   private static final Logger logger = LoggerFactory.getLogger(EnterpriseRecaptchaClient.class);
 
+  private final double scoreFloor;
+  private final String siteKey;
+  private final String projectPath;
+  private final RecaptchaEnterpriseServiceClient client;
+
+  public EnterpriseRecaptchaClient(
+      final double scoreFloor,
+      @Nonnull final String siteKey,
+      @Nonnull final String projectPath,
+      @Nonnull final String recaptchaCredentialConfigurationJson) {
+    try {
+      this.scoreFloor = scoreFloor;
+      this.siteKey = Objects.requireNonNull(siteKey);
+      this.projectPath = Objects.requireNonNull(projectPath);
+      this.client = RecaptchaEnterpriseServiceClient.create(RecaptchaEnterpriseServiceSettings.newBuilder()
+          .setCredentialsProvider(FixedCredentialsProvider.create(GoogleCredentials.fromStream(
+              new ByteArrayInputStream(recaptchaCredentialConfigurationJson.getBytes(StandardCharsets.UTF_8)))))
+          .build());
+    } catch (IOException e) {
+      throw new AssertionError(e);
+    }
+  }
+
   @Override
   public boolean verify(final String token, final String ip) {
-    return false;
+    Event event = Event.newBuilder()
+        .setExpectedAction("challenge")
+        .setSiteKey(siteKey)
+        .setToken(token)
+        .setUserIpAddress(ip)
+        .build();
+    final Assessment assessment = client.createAssessment(projectPath, Assessment.newBuilder().setEvent(event).build());
+
+    return assessment.getTokenProperties().getValid() && assessment.getRiskAnalysis().getScore() >= scoreFloor;
   }
 }