This response is archived.
@@ -197,7 +200,7 @@
Flagged
- <%= @submission.flagged %>
+ <%= boolean_to_text(@submission.flagged?) %>
|
@@ -205,7 +208,7 @@
Spam
|
- <%= @submission.spam? %>
+ <%= boolean_to_text(@submission.spam?) %>
|
@@ -214,7 +217,18 @@
|
<%- if @submission.spam_determination.present? %>
- <%= h(@submission.spam_determination.to_json) %>
+ <%- if @submission.spam_determination["source"] == "manual" %>
+ Marked manually
+ <% end %>
+ <%- if @submission.spam_determination["source"] == "automated" %>
+ Marked by Touchpoints
+ <% end %>
+ <%- if @submission.spam_determination["reasons"].present? %>
+
+ Reasons:
+ <%= @submission.spam_determination["reasons"].map { |reason| spam_reason_label(reason) }.join(", ") %>
+
+ <% end %>
<% end %>
|
@@ -223,7 +237,7 @@
Archived
- <%= @submission.archived? %>
+ <%= boolean_to_text(@submission.archived?) %>
|
@@ -231,7 +245,7 @@
Deleted
|
- <%= @submission.deleted? %>
+ <%= boolean_to_text(@submission.deleted?) %>
|
diff --git a/config/application.rb b/config/application.rb
index c2a2bfd9a..9c3e46296 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -19,6 +19,14 @@ class Application < Rails::Application
# Common ones are `templates`, `generators`, or `middleware`, for example.
# Initialize an array of Omniauth providers
config.x.omniauth.providers = []
+
+ # When enabled, spam submissions that are rejected are silently dropped
+ # (the client still receives a normal 200 OK) so spammers get no signal
+ # about what was detected. When disabled, rejected spam returns a 422.
+ # Kept as an env var toggle (per-deploy) but coerced to a real boolean so
+ # SILENTLY_REJECT_SPAM=false actually disables it.
+ config.x.silently_reject_spam =
+ ActiveModel::Type::Boolean.new.cast(ENV.fetch("SILENTLY_REJECT_SPAM", false))
config.i18n.available_locales = %w[en es zh-CN]
config.i18n.load_path += Dir[Rails.root.join('config', 'locales', '**', '*.{rb,yml}')]
config.generators do |g|
diff --git a/config/initializers/notifications.rb b/config/initializers/notifications.rb
index 1b9d8c728..7d52426a3 100644
--- a/config/initializers/notifications.rb
+++ b/config/initializers/notifications.rb
@@ -1,7 +1,3 @@
-ActiveSupport::Notifications.subscribe("spam_subverted") do |name, start, finish, request_id, payload|
- Rails.logger.warn("SPAM subverted from #{payload[:request].referer}, IP: #{payload[:request].remote_ip}, User-Agent: #{payload[:request].user_agent}")
-end
-
ActiveSupport::Notifications.subscribe("rack.attack") do |name, start, finish, request_id, payload|
Rails.logger.info("[Rack::Attack] #{payload[:request].ip} blocked for #{payload[:discriminator]}")
end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 0c9b27b4d..82052e94b 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2,7 +2,7 @@ en:
errors:
format: "%{attribute} %{message}"
request:
- unauthorized_host: "request made from non-authorized host"
+ spam_surface: "Please try again."
messages:
carrierwave_processing_error: failed to be processed
carrierwave_integrity_error: is not of an allowed file type
diff --git a/config/locales/es.yml b/config/locales/es.yml
index 1e854d081..cfb6853ef 100644
--- a/config/locales/es.yml
+++ b/config/locales/es.yml
@@ -161,7 +161,7 @@ es:
errors:
format: "%{attribute} %{message}"
request:
- unauthorized_host: "solicitud realizada desde un host no autorizado"
+ spam_surface: "Vuelva a intentarlo."
messages:
accepted: debe ser aceptado
blank: no puede estar en blanco
diff --git a/config/locales/zh-CN.yml b/config/locales/zh-CN.yml
index b8abae233..aa828e55a 100644
--- a/config/locales/zh-CN.yml
+++ b/config/locales/zh-CN.yml
@@ -157,7 +157,7 @@ zh-CN:
errors:
format: "%{attribute}%{message}"
request:
- unauthorized_host: "来自非授权主机的请求"
+ spam_surface: "请重试。"
messages:
accepted: 必须是可被接受的
blank: 不能为空字符
diff --git a/spec/controllers/submissions_controller_spec.rb b/spec/controllers/submissions_controller_spec.rb
index e5b151ff4..4fc0c9fff 100644
--- a/spec/controllers/submissions_controller_spec.rb
+++ b/spec/controllers/submissions_controller_spec.rb
@@ -81,22 +81,6 @@
end
describe 'POST #create' do
- context 'SPAMBOT' do
- it "won't create a submission if SPAMBOT detected" do
- spam_attributes = {
- form_id: form.id,
- answer_01: 'body text',
- answer_02: 'James',
- answer_03: 'Madison',
- answer_04: 'james.madison@lvh.me',
- fba_directive: 'SPAM text',
- }
- expect do
- post :create, params: { submission: spam_attributes, form_id: form.short_uuid }, session: valid_session
- end.to change(Submission, :count).by(0)
- end
- end
-
context 'with valid params and an ID' do
it 'creates a new Submission' do
expect do
@@ -130,6 +114,97 @@
end
end
+ context 'spam handling' do
+ # Stub the SpamChecker so these examples exercise the controller's
+ # response to each verdict without depending on real check behavior.
+ def stub_spam_verdict(verdict, flagged: [])
+ results = SpamChecker::SpamResults.new([])
+ allow(results).to receive(:verdict).and_return(verdict)
+ allow(results).to receive(:flagged).and_return(flagged)
+ allow_any_instance_of(SpamChecker).to receive(:call).and_return(results)
+ end
+
+ context 'when the submission is rejected' do
+ before { stub_spam_verdict(:reject) }
+
+ context 'and spam is silently rejected' do
+ before do
+ allow(Rails.configuration.x).to receive(:silently_reject_spam).and_return(true)
+ end
+
+ it 'does not persist the submission' do
+ expect do
+ post :create, params: { submission: valid_attributes, form_id: form.short_uuid }, session: valid_session
+ end.to change(Submission, :count).by(0)
+ form.reload
+ expect(form.response_count).to eq(0)
+ expect(form.last_response_created_at).to be nil
+ end
+
+ it 'redirects as if the submission succeeded, giving the spammer no signal' do
+ post :create, params: { submission: valid_attributes, form_id: form.short_uuid }, session: valid_session
+ expect(response).to redirect_to(submit_touchpoint_path(form))
+ end
+ end
+
+ context 'and spam is loudly rejected' do
+ before do
+ allow(Rails.configuration.x).to receive(:silently_reject_spam).and_return(false)
+ end
+
+ it 'does not persist the submission' do
+ expect do
+ post :create, params: { submission: valid_attributes, form_id: form.short_uuid }, session: valid_session, format: :json
+ end.to change(Submission, :count).by(0)
+ end
+
+ it 'returns a 422 rejecting the submission as spam' do
+ post :create, params: { submission: valid_attributes, form_id: form.short_uuid }, session: valid_session, format: :json
+ expect(response.status).to eq(422)
+ expect(JSON.parse(response.body)['status']).to eq('unprocessable_content')
+ expect(JSON.parse(response.body)['messages']).to eq({ 'submission' => ['Submission rejected as spam'] })
+ end
+ end
+ end
+
+ context 'when the submission is surfaced for a retry' do
+ before { stub_spam_verdict(:surface) }
+
+ it 'does not persist the submission' do
+ expect do
+ post :create, params: { submission: valid_attributes, form_id: form.short_uuid }, session: valid_session, format: :json
+ end.to change(Submission, :count).by(0)
+ end
+
+ it 'returns a 422 prompting the user to try again' do
+ post :create, params: { submission: valid_attributes, form_id: form.short_uuid }, session: valid_session, format: :json
+ expect(response.status).to eq(422)
+ expect(JSON.parse(response.body)['status']).to eq('unprocessable_content')
+ expect(JSON.parse(response.body)['messages']).to eq({ 'submission' => [I18n.t('errors.request.spam_surface')] })
+ end
+ end
+
+ context 'when the submission is flagged' do
+ before { stub_spam_verdict(:flag, flagged: %w[honeypot]) }
+
+ it 'persists the submission' do
+ expect do
+ post :create, params: { submission: valid_attributes, form_id: form.short_uuid }, session: valid_session
+ end.to change(Submission, :count).by(1)
+ end
+
+ it 'marks the submission as spam with automated provenance' do
+ post :create, params: { submission: valid_attributes, form_id: form.short_uuid }, session: valid_session
+ submission = Submission.last
+ expect(submission.spam).to be(true)
+ expect(submission.spam_determination).to eq(
+ 'source' => 'automated',
+ 'reasons' => %w[honeypot],
+ )
+ end
+ end
+ end
+
context 'with invalid params' do
before do
form.questions.first.update(is_required: true)
diff --git a/spec/features/touchpoints_spec.rb b/spec/features/touchpoints_spec.rb
index 3839edfe3..d02551a41 100644
--- a/spec/features/touchpoints_spec.rb
+++ b/spec/features/touchpoints_spec.rb
@@ -67,7 +67,7 @@
end
it 'fails the submission' do
- expect(page).to have_content('this submission was not successful')
+ expect(page).to have_content('Submission rejected as spam')
expect(page.current_path).to eq("/touchpoints/#{form.short_uuid}/submit") # stays on
end
end
diff --git a/spec/helpers/spam_helper_spec.rb b/spec/helpers/spam_helper_spec.rb
new file mode 100644
index 000000000..b57884016
--- /dev/null
+++ b/spec/helpers/spam_helper_spec.rb
@@ -0,0 +1,24 @@
+require 'rails_helper'
+
+RSpec.describe SpamHelper, type: :helper do
+ describe "#spam_reason_label" do
+ it "returns the check's label for a known reason" do
+ expect(helper.spam_reason_label('honeypot')).to eq('Hidden field was filled in')
+ end
+
+ it "humanizes an unknown reason" do
+ expect(helper.spam_reason_label('some_other_check')).to eq('Some other check')
+ end
+ end
+
+ describe "#spam_reason_description" do
+ it "returns the check's description for a known reason" do
+ expect(helper.spam_reason_description('turnstile'))
+ .to eq('The response did not pass the Cloudflare Turnstile bot-detection challenge.')
+ end
+
+ it "returns nil for an unknown reason" do
+ expect(helper.spam_reason_description('some_other_check')).to be_nil
+ end
+ end
+end
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index b804648b0..290e6519f 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -65,7 +65,7 @@
Capybara.server = :puma
Capybara.server_host = '127.0.0.1'
Capybara.server_port = 3000
-Capybara.app_host = 'http://127.0.0.1:3000'
+Capybara.app_host = 'http://localhost:3000'
TEST_API_KEY = '1234567890123456789012345678901234567890'
diff --git a/spec/services/spam_checks/base_spec.rb b/spec/services/spam_checks/base_spec.rb
new file mode 100644
index 000000000..8ec0cf24d
--- /dev/null
+++ b/spec/services/spam_checks/base_spec.rb
@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe SpamChecks::Base do
+ let(:submission) { Submission.new }
+
+ describe '#call' do
+ it 'returns :not_applied without calling #evaluate when not applicable' do
+ check_class = Class.new(described_class) do
+ const_set(:CHECK_NAME, 'test_check')
+ def applicable? = false
+ def evaluate = raise('should not be called')
+ end
+
+ result = check_class.new(submission: submission).call
+ expect(result.status).to eq(:not_applied)
+ end
+
+ it 'returns :reject when evaluate returns :reject' do
+ check_class = Class.new(described_class) do
+ const_set(:CHECK_NAME, 'test_check')
+ def evaluate = :reject
+ end
+
+ result = check_class.new(submission: submission).call
+ expect(result.status).to eq(:reject)
+ expect(result).to be_reject
+ end
+
+ it 'raises NotImplementedError when #evaluate is not overridden' do
+ check_class = Class.new(described_class) do
+ const_set(:CHECK_NAME, 'test_check')
+ end
+
+ expect do
+ check_class.new(submission: submission, context: {}).call
+ end.to raise_error(NotImplementedError)
+ end
+ end
+
+ describe '.check_name' do
+ it 'returns the declared CHECK_NAME constant' do
+ expect(SpamChecks::Honeypot.check_name).to eq('honeypot')
+ end
+ end
+
+ describe '.label' do
+ it 'returns the LABEL constant when set' do
+ expect(SpamChecks::Honeypot.label).to eq('Hidden field was filled in')
+ end
+
+ it 'humanizes the check name when LABEL is unset' do
+ check_class = Class.new(described_class) do
+ const_set(:CHECK_NAME, 'some_other_check')
+ end
+
+ expect(check_class.label).to eq('Some other check')
+ end
+ end
+
+ describe '.description' do
+ it 'returns the DESCRIPTION constant when set' do
+ expect(SpamChecks::Turnstile.description)
+ .to eq('The response did not pass the Cloudflare Turnstile bot-detection challenge.')
+ end
+
+ it 'returns nil when DESCRIPTION is unset' do
+ check_class = Class.new(described_class) do
+ const_set(:CHECK_NAME, 'some_other_check')
+ end
+
+ expect(check_class.description).to be_nil
+ end
+ end
+
+ describe '.for' do
+ it 'looks up a check class by its check name' do
+ expect(described_class.for('referer')).to eq(SpamChecks::Referer)
+ end
+
+ it 'returns nil for an unknown check name' do
+ expect(described_class.for('nope')).to be_nil
+ end
+ end
+
+ describe 'CHECK_NAME contract' do
+ it 'every registered check declares a CHECK_NAME' do
+ described_class.checks.each do |check|
+ expect { check.check_name }.not_to raise_error
+ expect(check.check_name).to be_present
+ end
+ end
+
+ it 'check names are unique across all registered checks' do
+ names = described_class.checks.map(&:check_name)
+ expect(names).to eq(names.uniq)
+ end
+ end
+end
diff --git a/spec/services/spam_checks/honeypot_spec.rb b/spec/services/spam_checks/honeypot_spec.rb
new file mode 100644
index 000000000..dfd97e1ed
--- /dev/null
+++ b/spec/services/spam_checks/honeypot_spec.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe SpamChecks::Honeypot do
+ def check(submission)
+ SpamChecks::Honeypot.new(submission: submission).call
+ end
+
+ it 'rejects when the honeypot field (fba_directive) is filled in' do
+ submission = Submission.new
+ submission.fba_directive = 'i am a bot'
+
+ expect(check(submission).status).to eq(:reject)
+ end
+
+ it 'passes when the honeypot field is blank' do
+ submission = Submission.new
+ submission.fba_directive = nil
+
+ expect(check(submission).status).to eq(:pass)
+ end
+end
diff --git a/spec/services/spam_checks/referer_spec.rb b/spec/services/spam_checks/referer_spec.rb
new file mode 100644
index 000000000..fb15042d2
--- /dev/null
+++ b/spec/services/spam_checks/referer_spec.rb
@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe SpamChecks::Referer do
+ def check(form:, context:)
+ submission = FactoryBot.build_stubbed(:submission, form:)
+ described_class.new(submission: submission, context: context).call
+ end
+
+ describe 'applicability' do
+ it 'is not applied when no referer is provided' do
+ form = FactoryBot.build_stubbed(:form, whitelist_url: 'https://agency.gov/')
+ result = check(
+ form: form,
+ context: { referer: nil, root_url: 'https://touchpoints.gov/' }
+ )
+ expect(result.status).to eq(:not_applied)
+ end
+ end
+
+ describe 'allowlist' do
+ it 'passes when the referer matches a form whitelist prefix' do
+ form = FactoryBot.build_stubbed(:form, whitelist_url: 'https://agency.gov/')
+ result = check(
+ form: form,
+ context: { referer: 'https://agency.gov/feedback', root_url: 'https://touchpoints.gov/' },
+ )
+ expect(result.status).to eq(:pass)
+ end
+
+ it 'passes when the referer matches the whitelist_test_url' do
+ form = FactoryBot.build_stubbed(:form, whitelist_url: '', whitelist_test_url: 'https://staging.agency.gov/')
+ result = check(
+ form: form,
+ context: { referer: 'https://staging.agency.gov/x', root_url: 'https://touchpoints.gov/' },
+ )
+ expect(result.status).to eq(:pass)
+ end
+
+ it 'ignores blank whitelist columns' do
+ # whitelist_url / whitelist_test_url default to "" — a blank prefix must
+ # not match every referer.
+ form = FactoryBot.build_stubbed(:form, whitelist_url: '', whitelist_test_url: '')
+ allow(form).to receive(:organization).and_return(nil)
+ result = check(
+ form: form,
+ context: { referer: 'https://evil.example/', root_url: nil },
+ )
+ expect(result.status).to eq(:flag)
+ end
+ end
+
+ describe 'Touchpoints application referer' do
+ it 'passes when the referer starts with the application root_url' do
+ form = FactoryBot.build_stubbed(:form, whitelist_url: '')
+ result = check(
+ form: form,
+ context: { referer: 'https://touchpoints.gov/some/page', root_url: 'https://touchpoints.gov/' },
+ )
+ expect(result.status).to eq(:pass)
+ end
+
+ it 'does not treat the referer as Touchpoints when root_url is nil' do
+ form = FactoryBot.build_stubbed(:form, whitelist_url: '')
+ allow(form).to receive(:organization).and_return(nil)
+ result = check(
+ form: form,
+ context: { referer: 'https://touchpoints.gov/some/page', root_url: nil },
+ )
+ expect(result.status).to eq(:flag)
+ end
+ end
+
+ describe "form organization's site" do
+ it 'passes when the referer starts with the organization url' do
+ organization = FactoryBot.build_stubbed(:organization, url: 'https://org.gov')
+ form = FactoryBot.build_stubbed(:form, organization: organization, whitelist_url: '')
+ result = check(
+ form: form,
+ context: { referer: 'https://org.gov/page', root_url: 'https://touchpoints.gov/' },
+ )
+ expect(result.status).to eq(:pass)
+ end
+
+ it 'rejects (does not raise) when the organization is nil' do
+ form = FactoryBot.build_stubbed(:form, whitelist_url: '')
+ allow(form).to receive(:organization).and_return(nil)
+ result = check(
+ form: form,
+ context: { referer: 'https://evil.example/', root_url: 'https://touchpoints.gov/' },
+ )
+ expect(result.status).to eq(:flag)
+ end
+
+ it 'rejects (does not raise) when the organization url is nil' do
+ organization = FactoryBot.build_stubbed(:organization, url: nil)
+ form = FactoryBot.build_stubbed(:form, organization: organization, whitelist_url: '')
+ result = check(
+ form: form,
+ context: { referer: 'https://evil.example/', root_url: 'https://touchpoints.gov/' },
+ )
+ expect(result.status).to eq(:flag)
+ end
+ end
+
+ describe 'flag' do
+ it 'flags when the referer is not allowlisted, not Touchpoints, and not the org site' do
+ organization = FactoryBot.build_stubbed(:organization, url: 'https://org.gov')
+ form = FactoryBot.build_stubbed(:form, organization: organization, whitelist_url: 'https://agency.gov/')
+ result = check(
+ form: form,
+ context: { referer: 'https://evil.example/', root_url: 'https://touchpoints.gov/' },
+ )
+ expect(result.status).to eq(:flag)
+ end
+
+ end
+end
diff --git a/spec/services/spam_checks/turnstile_spec.rb b/spec/services/spam_checks/turnstile_spec.rb
new file mode 100644
index 000000000..3fd238719
--- /dev/null
+++ b/spec/services/spam_checks/turnstile_spec.rb
@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe SpamChecks::Turnstile do
+
+ def check(form:, context:)
+ submission = FactoryBot.build_stubbed(:submission, form:)
+ SpamChecks::Turnstile.new(submission: submission, context: context).call
+ end
+
+ it 'is not applied when the form does not have Turnstile enabled' do
+ form = FactoryBot.build_stubbed(:form, enable_turnstile: false)
+ result = check(form: form, context: { remote_ip: '1.2.3.4' })
+
+ expect(result.status).to eq(:not_applied)
+ end
+
+ context 'when Turnstile is enabled' do
+ let(:form) { FactoryBot.build_stubbed(:form, enable_turnstile: true) }
+
+ it 'passes when the verifier confirms the token' do
+ verifier = double(verify: :pass)
+ result = check(
+ form: form,
+ context: { remote_ip: '1.2.3.4', verifier: verifier },
+ )
+
+ expect(result.status).to eq(:pass)
+ end
+
+ it 'surfaces when the verifier asks the user to try again' do
+ verifier = double(verify: :surface)
+ result = check(
+ form: form,
+ context: { remote_ip: '1.2.3.4', verifier: verifier },
+ )
+
+ expect(result.status).to eq(:surface)
+ end
+
+ it 'passes the token and remote_ip from the context to the verifier' do
+ verifier = double
+ expect(verifier).to receive(:verify).with(token: 'the-token', remote_ip: '1.2.3.4').and_return(:pass)
+
+ check(
+ form: form,
+ context: { remote_ip: '1.2.3.4', cf_turnstile_response: 'the-token', verifier: verifier },
+ )
+ end
+ end
+end
+
+RSpec.describe SpamChecks::TurnstileVerifier do
+ describe '.verify' do
+ def stub_cloudflare(body)
+ response = instance_double(Net::HTTPResponse, body: body)
+ allow(Net::HTTP).to receive(:post_form).and_return(response)
+ end
+
+ it 'surfaces without making a request when the token is blank' do
+ expect(Net::HTTP).not_to receive(:post_form)
+ expect(described_class.verify(token: '', remote_ip: '1.2.3.4')).to eq(:surface)
+ end
+
+ it 'surfaces without making a request when the token is nil' do
+ expect(Net::HTTP).not_to receive(:post_form)
+ expect(described_class.verify(token: nil, remote_ip: '1.2.3.4')).to eq(:surface)
+ end
+
+ it 'returns :pass when Cloudflare reports success' do
+ stub_cloudflare('{"success":true}')
+
+ expect(described_class.verify(token: 'good', remote_ip: '1.2.3.4')).to eq(:pass)
+ end
+
+ it 'fails open (:pass) when the secret key is missing' do
+ stub_cloudflare('{"success":false,"error-codes":["missing-input-secret"]}')
+
+ expect(described_class.verify(token: 'good', remote_ip: '1.2.3.4')).to eq(:pass)
+ end
+
+ it 'fails open (:pass) when the secret key is invalid' do
+ stub_cloudflare('{"success":false,"error-codes":["invalid-input-secret"]}')
+
+ expect(described_class.verify(token: 'good', remote_ip: '1.2.3.4')).to eq(:pass)
+ end
+
+ it 'surfaces when the token is a timeout or duplicate' do
+ stub_cloudflare('{"success":false,"error-codes":["timeout-or-duplicate"]}')
+
+ expect(described_class.verify(token: 'stale', remote_ip: '1.2.3.4')).to eq(:surface)
+ end
+
+ it 'surfaces when the token response is invalid' do
+ stub_cloudflare('{"success":false,"error-codes":["invalid-input-response"]}')
+
+ expect(described_class.verify(token: 'bad', remote_ip: '1.2.3.4')).to eq(:surface)
+ end
+
+ it 'fails open (:pass) on any other Cloudflare error' do
+ stub_cloudflare('{"success":false,"error-codes":["internal-error"]}')
+
+ expect(described_class.verify(token: 'good', remote_ip: '1.2.3.4')).to eq(:pass)
+ end
+
+ it 'fails open (:pass) when the request raises an error' do
+ allow(Net::HTTP).to receive(:post_form).and_raise(StandardError)
+
+ expect(described_class.verify(token: 'good', remote_ip: '1.2.3.4')).to eq(:pass)
+ end
+ end
+end
diff --git a/spec/services/spam_metrics_spec.rb b/spec/services/spam_metrics_spec.rb
new file mode 100644
index 000000000..5dfa89da5
--- /dev/null
+++ b/spec/services/spam_metrics_spec.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe SpamMetrics do
+ let(:results) do
+ { 'honeypot' => 'reject', 'referer' => 'pass', 'turnstile' => 'not_applied' }
+ end
+
+ describe '.record' do
+ context 'when NewRelic is available' do
+ before do
+ stub_const('NewRelic::Agent', class_double('NewRelic::Agent'))
+ allow(NewRelic::Agent).to receive(:increment_metric)
+ allow(NewRelic::Agent).to receive(:record_custom_event)
+ end
+
+ it 'increments one counter per check outcome plus a total' do
+ described_class.record(form_id: 42, verdict: :reject, results: results)
+
+ expect(NewRelic::Agent).to have_received(:increment_metric).with('Custom/Spam/honeypot/reject')
+ expect(NewRelic::Agent).to have_received(:increment_metric).with('Custom/Spam/referer/pass')
+ expect(NewRelic::Agent).to have_received(:increment_metric).with('Custom/Spam/turnstile/not_applied')
+ expect(NewRelic::Agent).to have_received(:increment_metric).with('Custom/Spam/reject')
+ end
+
+ it 'records a SpamCheck custom event with each check flattened to an attribute' do
+ described_class.record(form_id: 42, verdict: :reject, results: results)
+
+ expect(NewRelic::Agent).to have_received(:record_custom_event).with(
+ 'SpamCheck',
+ { form_id: 42, 'honeypot' => 'reject', 'referer' => 'pass', 'turnstile' => 'not_applied' }
+ )
+ end
+ end
+
+ context 'when NewRelic is not defined' do
+ it 'does not raise' do
+ hide_const('NewRelic::Agent') if defined?(NewRelic::Agent)
+ expect { described_class.record(form_id: 42, verdict: :reject, results: results) }.not_to raise_error
+ end
+ end
+ end
+end
diff --git a/touchpoints-demo.yml b/touchpoints-demo.yml
index e327057f6..b42f3cc72 100644
--- a/touchpoints-demo.yml
+++ b/touchpoints-demo.yml
@@ -20,6 +20,7 @@ applications:
TOUCHPOINTS_GTM_CONTAINER_ID:
TOUCHPOINTS_WEB_DOMAIN: touchpoints-demo.app.cloud.gov
SKIP_WIDGET_RENDERER: "true"
+ SILENTLY_REJECT_SPAM: "true"
buildpacks:
- https://github.com/rileyseaburg/rust-buildpack-touchpoints.git
- nodejs_buildpack
diff --git a/touchpoints-staging.yml b/touchpoints-staging.yml
index 4ff0246b4..8934b388b 100644
--- a/touchpoints-staging.yml
+++ b/touchpoints-staging.yml
@@ -27,6 +27,7 @@ applications:
ASSET_HOST: app-staging.touchpoints.digital.gov
SKIP_WIDGET_RENDERER: "true"
API_GATEWAY_BASE_URL: https://api.gsa.gov/test/analytics/touchpoints
+ SILENTLY_REJECT_SPAM: "true"
buildpacks:
- https://github.com/rileyseaburg/rust-buildpack-touchpoints.git
- nodejs_buildpack
diff --git a/touchpoints.yml b/touchpoints.yml
index 211c5acbb..0ff6eb3ce 100644
--- a/touchpoints.yml
+++ b/touchpoints.yml
@@ -15,6 +15,7 @@ applications:
INDEX_URL: /admin
SKIP_WIDGET_RENDERER: "true"
API_GATEWAY_BASE_URL: https://api.gsa.gov/analytics/touchpoints
+ SILENTLY_REJECT_SPAM: "true"
# Secrets managed via cf set-env (DO NOT add empty keys here):
# - AWS_SES_ACCESS_KEY_ID
# - AWS_SES_SECRET_ACCESS_KEY