{"action":"created","issue":{"url":"https://api.github.com/repos/18F/identity-idp/issues/2240","repository_url":"https://api.github.com/repos/18F/identity-idp","labels_url":"https://api.github.com/repos/18F/identity-idp/issues/2240/labels{/name}","comments_url":"https://api.github.com/repos/18F/identity-idp/issues/2240/comments","events_url":"https://api.github.com/repos/18F/identity-idp/issues/2240/events","html_url":"https://github.com/18F/identity-idp/pull/2240","id":332494897,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk0OTY0Njcw","number":2240,"title":"Add per-endpoint reCAPTCHA configuration","user":{"login":"mryenq","id":39062019,"node_id":"MDQ6VXNlcjM5MDYyMDE5","avatar_url":"https://avatars2.githubusercontent.com/u/39062019?v=4","gravatar_id":"","url":"https://api.github.com/users/mryenq","html_url":"https://github.com/mryenq","followers_url":"https://api.github.com/users/mryenq/followers","following_url":"https://api.github.com/users/mryenq/following{/other_user}","gists_url":"https://api.github.com/users/mryenq/gists{/gist_id}","starred_url":"https://api.github.com/users/mryenq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mryenq/subscriptions","organizations_url":"https://api.github.com/users/mryenq/orgs","repos_url":"https://api.github.com/users/mryenq/repos","events_url":"https://api.github.com/users/mryenq/events{/privacy}","received_events_url":"https://api.github.com/users/mryenq/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-06-14T17:28:33Z","updated_at":"2018-06-15T14:29:24Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/18F/identity-idp/pulls/2240","html_url":"https://github.com/18F/identity-idp/pull/2240","diff_url":"https://github.com/18F/identity-idp/pull/2240.diff","patch_url":"https://github.com/18F/identity-idp/pull/2240.patch"},"body":"**Why**:\r\n\r\nreCAPTCHA is currently included as a feature, but enabled or disabled\r\nglobally, and tied directly to AB testing. This change would add\r\nper-endpoint enablement of reCAPTCHA, connect it to the two currently\r\ntargeted flows (sign up and password reset) and support future ones,\r\nand decouple it from AB testing (to be re-implemented later, if desired).\r\n\r\n**How**:\r\n\r\nAdd reCAPTCHA application configuration global and action-based\r\nsettings.\r\n\r\nThe `application.yml.example` specifies example dev environment settings\r\nfor related endpoints (test and production are left empty, except for\r\nglobal default setting disabled).\r\n\r\nAlong with new and modified test coverage, manually tested scenarios\r\nincluded:\r\n\r\nWith reCAPTCHA globally disabled in app config:\r\n\r\n- create and confirm new account\r\n- forgot password and reset, confirm sign in\r\n- confirm no reCAPTCHA challenges are present\r\n\r\nWith reCAPTCHA globally enabled but no actions (endpoints) enabled in\r\napp config:\r\n\r\n- create and confirm new account\r\n- forgot password and reset, confirm sign in\r\n- confirm no reCAPTCHA challenges are present\r\n\r\nWith reCAPTCHA globally enabled and related actions (sign up and\r\npassword reset) enabled in app config:\r\n\r\n- create and confirm new account\r\n- forgot password and reset, confirm sign in\r\n- confirm reCAPTCHA challenges are present at both of the two configured\r\nsteps (sign up and password reset)\r\n\r\nNote: Without valid `recaptcha_site_key` and `recaptcha_secret_key`\r\nvalues set, reCAPTCHA will render for visual testing verification (with\r\nan \"Invalid site key\" message), but will not verify. Valid keys may be\r\nobtained from: https://www.google.com/recaptcha/admin. [This has been\r\ntested with valid keys.]\r\n\r\nHi! Before submitting your PR for review, and/or before merging it, please\r\ngo through the following checklist:\r\n\r\n- [x] For DB changes, check for missing indexes, check to see if the changes\r\naffect other apps (such as the dashboard), make sure the DB columns in the\r\nvarious environments are properly populated, coordinate with devops, plan\r\nmigrations in separate steps.\r\n\r\n- [x] For route changes, make sure GET requests don't change state or result in\r\ndestructive behavior. GET requests should only result in information being\r\nread, not written.\r\n\r\n- [x] For encryption changes, make sure it is compatible with data that was\r\nencrypted with the old code.\r\n\r\n- [x] For secrets changes, [make sure to update the S3 secrets bucket](https://github.com/18F/identity-private/wiki/Secrets-S3-buckets) with the \r\nnew configs in **all** environments. \r\n\r\n- [x] Do not disable Rubocop or Reek offenses unless you are absolutely sure\r\nthey are false positives. If you're not sure how to fix the offense, please\r\nask a teammate.\r\n\r\n- [x] When reading data, write tests for nil values, empty strings,\r\nand invalid formats.\r\n\r\n- [x] When calling `redirect_to` in a controller, use `_url`, not `_path`.\r\n\r\n- [x] When adding user data to the session, use the `user_session` helper\r\ninstead of the `session` helper so the data does not persist beyond the user's\r\nsession.\r\n\r\n- [x] When adding a new controller that requires the user to be fully\r\nauthenticated, make sure to add `before_action :confirm_two_factor_authenticated`.\r\n"},"comment":{"url":"https://api.github.com/repos/18F/identity-idp/issues/comments/397638892","html_url":"https://github.com/18F/identity-idp/pull/2240#issuecomment-397638892","issue_url":"https://api.github.com/repos/18F/identity-idp/issues/2240","id":397638892,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NzYzODg5Mg==","user":{"login":"stevegsa","id":34244063,"node_id":"MDQ6VXNlcjM0MjQ0MDYz","avatar_url":"https://avatars0.githubusercontent.com/u/34244063?v=4","gravatar_id":"","url":"https://api.github.com/users/stevegsa","html_url":"https://github.com/stevegsa","followers_url":"https://api.github.com/users/stevegsa/followers","following_url":"https://api.github.com/users/stevegsa/following{/other_user}","gists_url":"https://api.github.com/users/stevegsa/gists{/gist_id}","starred_url":"https://api.github.com/users/stevegsa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevegsa/subscriptions","organizations_url":"https://api.github.com/users/stevegsa/orgs","repos_url":"https://api.github.com/users/stevegsa/repos","events_url":"https://api.github.com/users/stevegsa/events{/privacy}","received_events_url":"https://api.github.com/users/stevegsa/received_events","type":"User","site_admin":false},"created_at":"2018-06-15T14:29:24Z","updated_at":"2018-06-15T14:29:24Z","author_association":"MEMBER","body":"I just noticed no LG number in the title.  Is this task in JIRA?"}}
{"actor":{"display_login":"stevegsa"}}