Merge lp:~maxiberta/canonical-identity-provider/drop-account-registration-captcha into lp:canonical-identity-provider/release

[Maximiliano Bertacchini]

Drop captcha from account registration (API & web).

Account registration captcha has been disabled for a long time (years?). And the implementation depends on reCaptcha v1 which is dead since March 2018. So, let's just drop all captcha bits from there.

=== modified file 'django_project/settings_base.py'
--- django_project/settings_base.py	2018-10-11 19:31:10 +0000
+++ django_project/settings_base.py	2018-10-16 20:29:23 +0000
@@ -229,7 +229,7 @@
     'raven.contrib.django.raven_compat',
     'canonical_raven',
 ]
-INTERNAL_IPS = []
+INTERNAL_IPS = ['127.0.0.1']  # Needed to tell user registration via WEB vs API
 LANGUAGES = [
     ['ar', 'Arabic'],
     ['az', 'Azerbaijani'],

=== modified file 'django_project/settings_devel.py'
--- django_project/settings_devel.py	2018-02-15 13:17:06 +0000
+++ django_project/settings_devel.py	2018-10-16 20:29:23 +0000
@@ -22,7 +22,6 @@
     'TWOFACTOR': {'is_active': True},
     'CAN_VIEW_SUPPORT_PHONE': {'is_active': True},
     'CAPTCHA': {'is_active': False},
-    'CAPTCHA_NEW_ACCOUNT': {'is_active': False},
     'PREFLIGHT': {'is_active': True},
     'LOGIN_BY_TOKEN': {'is_active': True},
     'SSH_KEY_INTEGRATION': {'is_active': False},

=== modified file 'src/api/v10/forms.py'
--- src/api/v10/forms.py	2015-05-08 19:25:27 +0000
+++ src/api/v10/forms.py	2018-10-16 20:29:23 +0000
@@ -5,17 +5,12 @@
 
 from __future__ import unicode_literals
 
-from django import forms
 from django.forms import fields
-from django.utils.translation import ugettext_lazy as _
 
 from identityprovider.forms import NewAccountForm
-from identityprovider.models.captcha import Captcha
 
 
 class WebserviceCreateAccountForm(NewAccountForm):
-    captcha_id = fields.CharField(max_length=1024)
-    captcha_solution = fields.CharField(max_length=256)
     remote_ip = fields.CharField(max_length=256)
     platform = fields.TypedChoiceField(choices=[
         ('web', 'Web'), ('desktop', 'Desktop'), ('mobile', 'Mobile')],
@@ -38,21 +33,3 @@
         if not validate_redirect_to:
             validate_redirect_to = None
         return validate_redirect_to
-
-    def clean(self):
-        cleaned_data = super(WebserviceCreateAccountForm, self).clean()
-        captcha_id = cleaned_data.get('captcha_id')
-        captcha_solution = cleaned_data.get('captcha_solution')
-
-        # The remote IP address is absolutely required, and comes from
-        # SSO itself, not from the client.  If it's missing, it's a
-        # programming error, and should not be returned to the client
-        # as a validation error.  So, we use a normal key lookup here.
-        remote_ip = cleaned_data['remote_ip']
-
-        captcha = Captcha(captcha_id)
-        email = cleaned_data.get('email', '')
-        if captcha.verify(captcha_solution, remote_ip, email):
-            return cleaned_data
-        # not verified
-        raise forms.ValidationError(_("Wrong captcha solution."))

=== modified file 'src/api/v10/handlers.py'
--- src/api/v10/handlers.py	2018-08-17 18:38:29 +0000
+++ src/api/v10/handlers.py	2018-10-16 20:29:23 +0000
@@ -17,6 +17,7 @@
 from django.shortcuts import render
 from django.utils.timezone import now
 from django.utils.translation import ugettext_lazy as _
+from gargoyle import gargoyle
 from oauth_backend.models import Token
 from piston.emitters import Emitter
 from piston.handler import BaseHandler
@@ -38,7 +39,6 @@
 from identityprovider.models.captcha import (
     Captcha,
     NewCaptchaError,
-    VerifyCaptchaError,
 )
 from identityprovider.models.const import AuthTokenType, EmailStatus
 from identityprovider.signals import (
@@ -184,28 +184,25 @@
 
     @named_operation
     def register(self, request):
+        remote_addr = request.environ['REMOTE_ADDR']
+        if (not gargoyle.is_active('USER_REGISTRATION_API_ENABLED', request)
+                and remote_addr not in settings.INTERNAL_IPS):
+            return api_error(HttpResponseForbidden,
+                             "User registration via API is disabled.")
+
         data = request.data
-        data['remote_ip'] = request.environ['REMOTE_ADDR']
+        data['remote_ip'] = remote_addr
         form = WebserviceCreateAccountForm(data)
-        try:
-            if not form.is_valid():
-                errors = dict((k, map(unicode, v))
-                              for (k, v) in form.errors.items())
-                # XXX: cope with client trimming error messages
-                if unicode(PASSWORD_LEAKED) in errors.get('password', ''):
-                    errors['password'] = unicode(_(
-                        'unsafe: leaked by security breach '
-                        'on another website'))
-                result = {'status': 'error', 'errors': errors}
-                return result
-        except VerifyCaptchaError:
-            logger.exception("reCaptcha connection error")
-            msg = unicode(
-                _('Unable to verify captcha. Please try again shortly.'))
-            return {
-                'status': 'error',
-                'errors': {'captcha_solution': [msg]}
-            }
+        if not form.is_valid():
+            errors = dict((k, map(unicode, v))
+                          for (k, v) in form.errors.items())
+            # XXX: cope with client trimming error messages
+            if unicode(PASSWORD_LEAKED) in errors.get('password', ''):
+                errors['password'] = unicode(_(
+                    'unsafe: leaked by security breach '
+                    'on another website'))
+            result = {'status': 'error', 'errors': errors}
+            return result
 
         cleaned_data = form.cleaned_data
         requested_email = cleaned_data['email']

=== modified file 'src/api/v10/tests/test_forms.py'
--- src/api/v10/tests/test_forms.py	2015-11-24 14:38:04 +0000
+++ src/api/v10/tests/test_forms.py	2018-10-16 20:29:23 +0000
@@ -5,23 +5,12 @@
 
 from __future__ import unicode_literals
 
-from django.test.utils import override_settings
-
 from api.v10.forms import WebserviceCreateAccountForm
 from identityprovider.tests.utils import SSOBaseTestCase
 
 
-@override_settings(CAPTCHA_PUBLIC_KEY='public', CAPTCHA_PRIVATE_KEY='private')
 class WebServiceCreateAccountFormTestCase(SSOBaseTestCase):
 
-    def setUp(self):
-        super(WebServiceCreateAccountFormTestCase, self).setUp()
-        # patch Captcha so it never hits the real network
-        self.mock_captcha_open = self.patch(
-            'identityprovider.models.captcha.Captcha._open')
-        self.mock_captcha_open.return_value.is_error = False
-        self.mock_captcha_open.return_value.data.return_value = 'true\nyey'
-
     def test_nonascii_password(self):
         data = {'password': 'Curuzú Cuatiá',
                 'remote_ip': '127.0.0.1'}
@@ -46,19 +35,6 @@
         self.assertTrue(form.is_valid())
         self.assertEqual(form.cleaned_data['platform'], 'desktop')
 
-    def test_captcha_checked_for_whitelist(self):
-        data = {
-            'email': '[e-mail]',
-            'password': 'password1A',
-            'captcha_id': '1',
-            'captcha_solution': '2',
-            'remote_ip': '127.0.0.1',
-        }
-        pattern = '^canonicaltest(?:\+.+)?@gmail\.com$'
-        with self.settings(EMAIL_WHITELIST_REGEXP_LIST=[pattern]):
-            form = WebserviceCreateAccountForm(data)
-            self.assertTrue(form.is_valid())
-
     def test_default_cleaned_validate_redirect_to(self):
         data = {
             'email': '[e-mail]',

=== modified file 'src/api/v10/tests/test_handlers.py'
--- src/api/v10/tests/test_handlers.py	2018-05-28 17:22:45 +0000
+++ src/api/v10/tests/test_handlers.py	2018-10-16 20:29:23 +0000
@@ -391,6 +391,62 @@
                  'captcha_solution': 'foobar',
                  'captcha_id': 'id'})
 
+    @switches(USER_REGISTRATION_API_ENABLED=False)
+    @override_settings(INTERNAL_IPS=['127.0.0.1'])
+    def test_feature_flag_disabled_with_internal_remote_addr(self):
+        # Request uses 127.0.0.1, which is treated as an internal IP.
+        email = self.factory.make_email_address()
+
+        response = self.api.registrations.register(
+            email=email, password='MySecretPassword1',
+            captcha_solution='foobar', captcha_id='id',
+            displayname='Test User')
+
+        self.assertEqual(response['status'], 'ok')
+        Account.objects.get_by_email(email)
+
+    @switches(USER_REGISTRATION_API_ENABLED=False)
+    @override_settings(INTERNAL_IPS=['10.0.0.1'])
+    def test_feature_flag_disabled_with_external_remote_addr(self):
+        # Request uses 127.0.0.1, which is treated as an *external* IP here.
+        email = self.factory.make_email_address()
+
+        with self.assertRaises(HTTPError) as ctx:
+            self.api.registrations.register(
+                email=email, password='MySecretPassword1',
+                captcha_solution='foobar', captcha_id='id',
+                displayname='Test User')
+
+        self.assertEqual(ctx.exception.response.status, 403)
+
+    @switches(USER_REGISTRATION_API_ENABLED=True)
+    @override_settings(INTERNAL_IPS=['127.0.0.1'])
+    def test_feature_flag_enabled_with_internal_remote_addr(self):
+        # Request uses 127.0.0.1, which is treated as an internal IP.
+        email = self.factory.make_email_address()
+
+        response = self.api.registrations.register(
+            email=email, password='MySecretPassword1',
+            captcha_solution='foobar', captcha_id='id',
+            displayname='Test User')
+
+        self.assertEqual(response['status'], 'ok')
+        Account.objects.get_by_email(email)
+
+    @switches(USER_REGISTRATION_API_ENABLED=True)
+    @override_settings(INTERNAL_IPS=['10.0.0.1'])
+    def test_feature_flag_enabled_with_external_remote_addr(self):
+        # Request uses 127.0.0.1, which is treated as an *external* IP here.
+        email = self.factory.make_email_address()
+
+        response = self.api.registrations.register(
+            email=email, password='MySecretPassword1',
+            captcha_solution='foobar', captcha_id='id',
+            displayname='Test User')
+
+        self.assertEqual(response['status'], 'ok')
+        Account.objects.get_by_email(email)
+
 
 class AuthenticationTestCase(SSOBaseTestCase):
 

=== modified file 'src/api/v20/handlers.py'
--- src/api/v20/handlers.py	2018-08-17 18:38:29 +0000
+++ src/api/v20/handlers.py	2018-10-16 20:29:23 +0000
@@ -52,7 +52,6 @@
     Token,
     twofactor,
 )
-from identityprovider.models.captcha import Captcha, VerifyCaptchaError
 from identityprovider.models.const import (
     AccountStatus,
     AuthLogType,
@@ -61,7 +60,6 @@
 )
 from identityprovider.signals import login_failed, login_succeeded
 from identityprovider.stats import stats
-from identityprovider.timeline_helpers import get_request_timing_function
 from identityprovider.utils import redirection_url_for_token
 from webservices.launchpad import get_lp_ssh_keys
 
@@ -282,8 +280,12 @@
     @throttle()
     def create(self, request):
         """Create/register a new account."""
+        remote_addr = request.environ['REMOTE_ADDR']
+        if (not gargoyle.is_active('USER_REGISTRATION_API_ENABLED', request)
+                and remote_addr not in settings.INTERNAL_IPS):
+            return errors.FEATURE_DISABLED()
+
         data = request.data
-
         try:
             email = data['email']
             password = data['password']
@@ -294,43 +296,6 @@
             return errors.INVALID_DATA(**missing)
 
         username = data.get('username')
-        captcha_required = (gargoyle.is_active('CAPTCHA', request) and
-                            gargoyle.is_active('CAPTCHA_NEW_ACCOUNT', request))
-
-        captcha_id = data.get('captcha_id')
-        captcha_solution = data.get('captcha_solution')
-        if not (captcha_solution and captcha_id) and captcha_required:
-            extra = {}
-            if data.get('create_captcha', True):
-                timer = get_request_timing_function(request)
-                try:
-                    extra = Captcha.new(timer=timer).serialize()
-                except Exception:
-                    logger.exception('failed to create reCaptcha')
-            return errors.CAPTCHA_REQUIRED(**extra)
-
-        elif captcha_id:
-            remote_addr = request.environ['REMOTE_ADDR']
-            captcha = Captcha(captcha_id)
-            verified = False
-            try:
-                timer = get_request_timing_function(request)
-                verified = captcha.verify(
-                    captcha_solution, remote_addr, data['email'],
-                    timer=timer)
-            except VerifyCaptchaError as e:
-                # only expose HTTP error codes to client
-                code = e.response.code if e.response.code > 200 else None
-                return errors.CAPTCHA_ERROR(
-                    recaptcha_reason=e.response.reason,
-                    recaptcha_status_code=code,
-                    recaptcha_body=e.response.body)
-            except Exception:
-                logger.exception("reCaptcha error")
-
-            if not verified:
-                message = getattr(captcha, 'message', '')
-                return errors.CAPTCHA_FAILURE(captcha_message=message)
 
         root_url = request.build_absolute_uri('/')
         try:
@@ -365,8 +330,6 @@
         The newly created account will be verified and passwordless,
         and the owner will not be able to login until a password reset is done.
 
-        Captcha is completely ignored.
-
         """
         data = request.data
 

=== modified file 'src/api/v20/tests/test_handlers.py'
--- src/api/v20/tests/test_handlers.py	2018-09-13 20:19:21 +0000
+++ src/api/v20/tests/test_handlers.py	2018-10-16 20:29:23 +0000
@@ -7,9 +7,8 @@
 import time
 import uuid
 
-from StringIO import StringIO
 from urllib import quote, urlencode
-from urlparse import parse_qsl, urlparse, urlunparse
+from urlparse import urlparse, urlunparse
 
 from django.conf import settings
 from django.contrib.auth.hashers import make_password
@@ -35,7 +34,6 @@
     AuthToken,
     EmailAddress,
     Token,
-    captcha,
 )
 from identityprovider.models.const import (
     AccountCreationRationale,
@@ -616,195 +614,34 @@
         self.assert_bad_request(
             data=self.data, extra={'email': ['Invalid email']})
 
-
-@override_settings(CAPTCHA_PUBLIC_KEY='public', CAPTCHA_PRIVATE_KEY='private')
-class AnonymousAccountRegistrationWithCaptchaHandlerTestCase(BaseTestCase):
-
-    url = reverse('api-registration')
-
-    def setUp(self):
-        super(AnonymousAccountRegistrationWithCaptchaHandlerTestCase,
-              self).setUp()
-        p = switches(CAPTCHA=True, CAPTCHA_NEW_ACCOUNT=True)
-        p.patch()
-        self.addCleanup(p.unpatch)
-
-        self.captcha_response = captcha.CaptchaResponse(
-            code=42, response=StringIO("challenge: '999'"))
-        self.mock_captcha_open = self.patch(
-            'api.v20.handlers.Captcha._open',
-            return_value=self.captcha_response)
-
-        self.data = {
-            'email': self.factory.make_email_address(),
-            'password': 'asdfASDF1',
-            'displayname': 'Ricardo the Magnificent',
-            'captcha_id': '999',
-            'captcha_solution': 'foo bar',
-        }
-
-    def test_register_captcha_required(self):
-        captcha_data = {
-            'captcha_id': '999',
-            'image_url': settings.CAPTCHA_IMAGE_URL_PATTERN % '999'}
-        del self.data['captcha_id']
-        del self.data['captcha_solution']
-
-        json_body = self.do_post(self.data, status_code=401)
-
-        self.assertEqual(json_body['code'], "CAPTCHA_REQUIRED")
-        self.assertIn('A captcha challenge is required', json_body['message'])
-        self.assertIsNone(Account.objects.get_by_email(self.data['email']))
-        self.assertEqual(json_body['extra'], captcha_data)
-
-    def test_register_captcha_success(self):
-        self.captcha_response.response = StringIO('true\nok')
+    @switches(USER_REGISTRATION_API_ENABLED=False)
+    @override_settings(INTERNAL_IPS=['127.0.0.1'])
+    def test_feature_flag_disabled_with_internal_remote_addr(self):
+        # Request uses 127.0.0.1, which is treated as an internal IP.
         json_body = self.do_post(self.data, status_code=201)
-
-        url_request = self.mock_captcha_open.call_args[0][0]
-        self.assertEqual(
-            url_request.get_full_url(), settings.CAPTCHA_VERIFY_URL)
-        data = dict(parse_qsl(url_request.data))
-        expected = {
-            'challenge': '999', 'privatekey': settings.CAPTCHA_PRIVATE_KEY,
-            'remoteip': '127.0.0.1', 'response': 'foo bar'}
-        self.assertEqual(data, expected)
-
-        self.assertIn('openid', json_body)
-        self.assertIn('href', json_body)
-        self.assertEqual(json_body['email'], self.data['email'])
-        self.assertEqual(json_body['displayname'], self.data['displayname'])
-        self.assertEqual(json_body['status'], 'Active')
-        self.assertEqual(len(json_body['emails']), 1)
-        self.assertIn(quote(self.data['email'], safe='@'),
-                      json_body['emails'][0]['href'])
-
-    def test_register_captcha_failure(self):
-        self.captcha_response.is_error = False
-
-        self.data['captcha_id'] = '999'
-        self.data['captcha_solution'] = 'foo bar'
-
+        self.assert_correct_account_information(json_body)
+
+    @switches(USER_REGISTRATION_API_ENABLED=False)
+    @override_settings(INTERNAL_IPS=['10.0.0.1'])
+    def test_feature_flag_disabled_with_external_remote_addr(self):
+        # Request uses 127.0.0.1, which is treated as an *external* IP here.
         json_body = self.do_post(self.data, status_code=403)
-
-        url_request = self.mock_captcha_open.call_args[0][0]
-        self.assertEqual(
-            url_request.get_full_url(), settings.CAPTCHA_VERIFY_URL)
-        data = dict(parse_qsl(url_request.data))
-        expected = {
-            'challenge': '999', 'privatekey': settings.CAPTCHA_PRIVATE_KEY,
-            'remoteip': '127.0.0.1', 'response': 'foo bar'}
-        self.assertEqual(data, expected)
-
-        self.assertEqual(json_body['code'], "CAPTCHA_FAILURE")
-        self.assertIn(
-            'Failed response to captcha challenge.', json_body['message'])
-        self.assertIsNone(Account.objects.get_by_email(self.data['email']))
-
-    def test_register_captcha_whitelist(self):
-        self.data['email'] = '[e-mail]'
-        self.data['captcha_id'] = '999'
-        self.data['captcha_solution'] = 'foo bar'
-
-        with self.settings(**OVERRIDES):
-            self.do_post(self.data, status_code=201)
-
-        self.assertIsNotNone(Account.objects.get_by_email(self.data['email']))
-        self.assertFalse(self.mock_captcha_open.called)
-
-    def test_register_captcha_whitelist_with_uuid(self):
-        self.data['email'] = '[e-mail]'
-        self.data['captcha_id'] = '999'
-        self.data['captcha_solution'] = 'foo bar'
-
-        with self.settings(**OVERRIDES):
-            self.do_post(self.data, status_code=201)
-
-        self.assertIsNotNone(Account.objects.get_by_email(self.data['email']))
-        self.assertFalse(self.mock_captcha_open.called)
-
-    def test_register_captcha_whitelist_fail(self):
-        self.data['captcha_id'] = '999'
-        self.data['captcha_solution'] = 'foo bar'
-        self.data['email'] = '[e-mail]'
-
-        self.captcha_response.is_error = False
-        self.captcha_response.response = StringIO('false\nmessage')
-
-        with self.settings(**OVERRIDES):
-            self.do_post(self.data, status_code=403)
-
-        self.assertIsNone(Account.objects.get_by_email(self.data['email']))
-        self.assertTrue(self.mock_captcha_open.called)
-
-    def test_register_captcha_http_error(self):
-        response = captcha.CaptchaResponse(
-            500, None, "", "Server error", "Unexpected recaptcha error")
-        error = captcha.VerifyCaptchaError(response)
-        self.mock_captcha_open.side_effect = error
-
-        self.data['captcha_id'] = '999'
-        self.data['captcha_solution'] = 'foo bar'
-
-        json_body = self.do_post(self.data, status_code=502)
-
-        self.assertEqual(json_body['code'], "CAPTCHA_ERROR")
-        self.assertIn('Unable to get a valid response from reCaptcha service',
-                      json_body['message'])
-        extra = json_body['extra']
-        self.assertEqual(extra['recaptcha_reason'], "Server error")
-        self.assertEqual(extra['recaptcha_status_code'], 500)
-        self.assertEqual(extra['recaptcha_body'], "Unexpected recaptcha error")
-        self.assertIsNone(Account.objects.get_by_email(self.data['email']))
-
-    def test_register_captcha_network_error(self):
-        response = captcha.CaptchaResponse(111, None, "", "Connection refused")
-        error = captcha.VerifyCaptchaError(response)
-        self.mock_captcha_open.side_effect = error
-
-        self.data['captcha_id'] = '999'
-        self.data['captcha_solution'] = 'foo bar'
-
-        json_body = self.do_post(self.data, status_code=502)
-
-        self.assertEqual(json_body['code'], "CAPTCHA_ERROR")
-        self.assertIn('Unable to get a valid response from reCaptcha service',
-                      json_body['message'])
-        extra = json_body['extra']
-        self.assertEqual(extra['recaptcha_reason'], "Connection refused")
-        self.assertEqual(extra['recaptcha_status_code'], None)
-        self.assertEqual(extra['recaptcha_body'], None)
-        self.assertIsNone(Account.objects.get_by_email(self.data['email']))
-
-    def test_timeline_for_captcha_generation(self):
-        timeline = Timeline()
-        meta = {
-            'timeline.timeline': timeline,
-        }
-        data = self.data.copy()
-        data.pop('captcha_id')
-        data.pop('captcha_solution')
-        data['create_captcha'] = True
-
-        self.do_post(data, status_code=401, **meta)
-
-        self.assertEqual(1, len(timeline.actions))
-        self.assertEqual('captcha-new', timeline.actions[0].category)
-        self.assertEqual(self.mock_captcha_open.call_args[0][0],
-                         timeline.actions[0].detail)
-
-    def test_timeline_for_captcha_verification(self):
-        self.mock_captcha_open.return_value = captcha.CaptchaResponse(
-            500, StringIO('false\nsomething'))
-        timeline = Timeline()
-        meta = {
-            'timeline.timeline': timeline,
-        }
-
-        self.do_post(self.data, status_code=403, **meta)
-
-        self.assertEqual(1, len(timeline.actions))
-        self.assertEqual('captcha-verify', timeline.actions[0].category)
+        self.assertEqual(json_body['code'], "FEATURE_DISABLED")
+        self.assertEqual("Feature disabled.", json_body['message'])
+
+    @switches(USER_REGISTRATION_API_ENABLED=True)
+    @override_settings(INTERNAL_IPS=['127.0.0.1'])
+    def test_feature_flag_enabled_with_internal_remote_addr(self):
+        # Request uses 127.0.0.1, which is treated as an internal IP.
+        json_body = self.do_post(self.data, status_code=201)
+        self.assert_correct_account_information(json_body)
+
+    @switches(USER_REGISTRATION_API_ENABLED=True)
+    @override_settings(INTERNAL_IPS=['10.0.0.1'])
+    def test_feature_flag_enabled_with_external_remote_addr(self):
+        # Request uses 127.0.0.1, which is treated as an *external* IP here.
+        json_body = self.do_post(self.data, status_code=201)
+        self.assert_correct_account_information(json_body)
 
 
 class AccountRegistrationHandlerTestCase(BaseTestCase):
@@ -2268,8 +2105,6 @@
         email = '[e-mail]'
 
         data = {
-            'captcha_id': 'some-id',
-            'captcha_solution': 'some solution',
             'email': '[e-mail]',
             'password': 'some-password-123',
             'displayname': 'Some User',

=== modified file 'src/api/v20/utils.py'
--- src/api/v20/utils.py	2018-05-28 17:22:45 +0000
+++ src/api/v20/utils.py	2018-10-16 20:29:23 +0000
@@ -67,6 +67,7 @@
 class ErrorCode:
     ACCOUNT_NOT_READY = 'account-not-ready'
     BAD_REQUEST = 'bad-request'
+    FEATURE_DISABLED = 'feature-disabled'
     INTERNAL_ERROR = 'internal-server-error'
     INVALID_DATA = 'invalid-data'
     INVALID_CREDENTIALS = 'invalid-credentials'
@@ -141,6 +142,10 @@
         403, _("Insufficient permissions."),
         ErrorCode.PERMISSION_REQUIRED),
 
+    FEATURE_DISABLED=(
+        403, _("Feature disabled."),
+        ErrorCode.FEATURE_DISABLED),
+
     RESOURCE_NOT_FOUND=(
         404, _("The resource requested was not found."),
         ErrorCode.RESOURCE_NOT_FOUND),

=== modified file 'src/webui/templates/registration/_create_account_form.html'
--- src/webui/templates/registration/_create_account_form.html	2018-07-04 17:51:43 +0000
+++ src/webui/templates/registration/_create_account_form.html	2018-10-16 20:29:23 +0000
@@ -50,17 +50,6 @@
 
     {% include "widgets/passwords.html" with fields=create_form %}
 
-    {% if captcha_required %}
-    <div class="captcha" id="captcha">
-        {% if captcha_error_message %}
-            <span class="error">
-                {{ captcha_error_message }}
-            </span>
-        {% endif %}
-        {% include "widgets/recaptcha.html" %}
-    </div>
-    {% endif %}
-
     <div class="input-row{% if create_form.accept_tos.errors %} haserrors{% endif %} accept-tos-input">
 
         {% if create_form.accept_tos.errors %}

=== removed file 'src/webui/templates/widgets/recaptcha.html'
--- src/webui/templates/widgets/recaptcha.html	2014-12-11 17:44:29 +0000
+++ src/webui/templates/widgets/recaptcha.html	1970-01-01 00:00:00 +0000
@@ -1,43 +0,0 @@
-{% comment %}
-Copyright 2010 Canonical Ltd.  This software is licensed under the
-GNU Affero General Public License version 3 (see the file  LICENSE).
-{% endcomment %}
-
-{% load i18n %}
-{% load static_url %}
-<script type="text/javascript">
-    var RecaptchaOptions = {
-        theme: 'white',
-        custom_translations: {
-          visual_challenge : "{% trans "Get a visual challenge" %}",
-          audio_challenge : "{% trans "Get an audio challenge" %}",
-          refresh_btn : "{% trans "Get a new challenge" %}",
-          instructions_visual : "{% trans "Type the two words:" %}",
-          instructions_audio : "{% trans "Type what you hear:" %}",
-          help_btn : "{% trans "Help" %}",
-          play_again : "{% trans "Play sound again" %}",
-          cant_hear_this : "{% trans "Download sound as MP3" %}",
-          incorrect_try_again : "{% trans "Incorrect. Try again." %}"
-        },
-    };
-</script>
-<div {% if captcha_error %}class='captchaError'{% endif %}>
-{% ifequal captcha_error "&error=no-challenge" %}
-<p>
-{% blocktrans with "support_form"|static_url as support_form_url %}
-It appears that our captcha service was unable to load on this page.
-This may be caused by a plugin on your browser.
-Please correct this and try again. If the problem persists, please <a href="{{ support_form_url }}">contact support</a>
-{% endblocktrans %}
-</p>
-{% endifequal %}
-<script type="text/javascript" src="{{ CAPTCHA_API_URL_SECURE }}/challenge?k={{ CAPTCHA_PUBLIC_KEY }}{{ captcha_error }}">
-</script>
-<noscript>
-    <iframe src="{{ CAPTCHA_API_URL_SECURE }}/noscript?k={{ CAPTCHA_PUBLIC_KEY }}" height="300" width="500" frameborder="0" class="recaptcha-noscript">
-    </iframe>
-    <textarea class="recaptcha-challenge-field" name="recaptcha_challenge_field" rows="3" cols="40">
-    </textarea>
-    <input type="hidden" name="recaptcha_response_field" value="manual_challenge">
-</noscript>
-</div>

=== modified file 'src/webui/tests/test_views_registration.py'
--- src/webui/tests/test_views_registration.py	2018-05-28 20:15:33 +0000
+++ src/webui/tests/test_views_registration.py	2018-10-16 20:29:23 +0000
@@ -161,16 +161,6 @@
         ctx = response.context_data
         self.assertEqual(ctx['form']['email'].value(), '[e-mail]')
 
-    @switches(CAPTCHA=False)
-    def test_get_optional_captcha_switch_off(self):
-        response = self.get()
-        self.assertEqual(response.context_data['captcha_required'], False)
-
-    @switches(CAPTCHA=True, CAPTCHA_NEW_ACCOUNT=True)
-    def test_get_optional_captcha_switch_on(self):
-        response = self.get()
-        self.assertEqual(response.context_data['captcha_required'], True)
-
     def test_post_required_fields(self):
         response = self.post()
         self.assert_form_displayed(
@@ -213,9 +203,6 @@
             email=self.TESTDATA['email'],
             password=self.TESTDATA['password'],
             displayname=self.TESTDATA['displayname'],
-            captcha_id=None,
-            captcha_solution=None,
-            create_captcha=False,
             creation_source=WEB_CREATION_SOURCE,
         )
 
@@ -242,9 +229,6 @@
             password=self.TESTDATA['password'],
             displayname=self.TESTDATA['displayname'],
             username=self.TESTDATA['username'],
-            captcha_id=None,
-            captcha_solution=None,
-            create_captcha=False,
             creation_source=WEB_CREATION_SOURCE,
         )
         self.TESTDATA.pop('username')
@@ -337,9 +321,6 @@
         expected_args = dict(email=self.TESTDATA['email'],
                              password=self.TESTDATA['password'],
                              displayname=self.TESTDATA['displayname'],
-                             create_captcha=False,
-                             captcha_solution=None,
-                             captcha_id=None,
                              creation_source='web-flow',
                              oid_token=token)
         self.mock_api_register.assert_called_once_with(**expected_args)
@@ -351,38 +332,6 @@
         self.assert_form_displayed(response, email=VERIFY_EMAIL_MESSAGE)
         self.assert_stat_calls(['error.email'])
 
-    def test_post_captcha_required(self):
-        exc = api_errors.CaptchaRequired(Mock())
-        self.mock_api_register.side_effect = exc
-        response = self.post(**self.TESTDATA)
-        self.assert_form_displayed(response)
-        self.assertEqual(response.context_data['captcha_required'], True)
-
-    def test_post_captcha_failure(self):
-        mock_response = Mock()
-        body = {'extra': {'captcha_message': 'XXX'}}
-        exc = api_errors.CaptchaFailure(mock_response, body)
-        self.mock_api_register.side_effect = exc
-
-        response = self.post(**self.TESTDATA)
-        self.assert_form_displayed(response)
-        self.assertEqual(response.context_data['captcha_required'], True)
-        self.assertEqual(
-            response.context_data['captcha_error'],
-            '&error=XXX')
-        self.assert_stat_calls(['error.captcha'])
-
-    def test_post_captcha_error(self):
-        mock_response = Mock()
-        body = {}
-        exc = api_errors.CaptchaError(mock_response, body)
-        self.mock_api_register.side_effect = exc
-
-        response = self.post(**self.TESTDATA)
-        self.assert_form_displayed(response)
-        self.assertEqual(response.context_data['captcha_required'], True)
-        self.assert_stat_calls(['error.captcha'])
-
 
 class RegisterTimelineTestCase(
         SSOBaseTestCase, RegisterTestMixin, TimelineActionMixin):

=== modified file 'src/webui/tests/test_views_ui.py'
--- src/webui/tests/test_views_ui.py	2018-09-07 21:54:44 +0000
+++ src/webui/tests/test_views_ui.py	2018-10-16 20:29:23 +0000
@@ -10,7 +10,6 @@
 import urllib2
 from datetime import date
 from functools import partial
-from StringIO import StringIO
 from urlparse import urlsplit
 
 from django.conf import settings
@@ -29,7 +28,6 @@
 from django.test.utils import override_settings
 from django.urls import reverse
 from django.utils.html import escape
-from gargoyle import gargoyle
 from gargoyle.testutils import switches
 from mock import Mock, patch
 from pyquery import PyQuery
@@ -50,11 +48,7 @@
     OpenIDRPConfig,
     twofactor,
 )
-from identityprovider.models.captcha import (
-    Captcha,
-    CaptchaResponse,
-    CaptchaV2,
-)
+from identityprovider.models.captcha import CaptchaV2
 from identityprovider.models.const import (
     AccountStatus,
     AuthLogType,
@@ -65,7 +59,6 @@
 from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.test_auth import AuthLogTestCaseMixin
 from identityprovider.tests.utils import (
-    MockHandler,
     SSOBaseTestCase,
     TimelineActionMixin,
 )
@@ -115,9 +108,6 @@
             'passwordconfirm': 'Testing123',
             'accept_tos': True
         }
-        if gargoyle.is_active('CAPTCHA'):
-            data['recaptcha_challenge_field'] = 'ignored'
-            data['recaptcha_response_field'] = 'ignored'
 
         return self.client.post(url, data, follow=follow)
 
@@ -132,24 +122,6 @@
         assert self.client.login(
             username=self.data['email'], password=self.data['password'])
 
-    def request_when_captcha_fails(self, url, data):
-        class MockCaptcha(object):
-            def __init__(self, *args):
-                pass
-
-            def verify(self, solution, ip_addr, email):
-                self.message = 'no-challenge'
-                return False
-
-            @classmethod
-            def new(cls, env):
-                return cls()
-
-        with patch.object(ui, 'Captcha', MockCaptcha):
-            r = self.client.post(url, data)
-
-        return r
-
 
 @override_settings(LANGUAGE_CODE='es')
 class SpanishUIViewsTestCase(BaseTestCase):
@@ -1348,62 +1320,6 @@
         self.assertFalse(email.is_verified)
 
 
-@override_settings(CAPTCHA_PRIVATE_KEY='some-private-key')
-class CaptchaVerificationTestCase(BaseTestCase):
-
-    success_status = 302
-
-    def setUp(self):
-        super(CaptchaVerificationTestCase, self).setUp()
-        mock_handler = MockHandler()
-        mock_handler.set_next_response(200, 'false\nno-challenge')
-        self.patch(Captcha, 'opener', new=urllib2.build_opener(mock_handler))
-
-        p = switches(CAPTCHA=True)
-        p.patch()
-        self.addCleanup(p.unpatch)
-
-    def test_new_account_when_form_validation_fails(self):
-        r = self.post_new_account()
-        self.assertTemplateUsed(r, 'registration/new_account.html')
-        msg = 'It appears that our captcha service was unable to load'
-        self.assertContains(r, msg)
-
-    def test_new_account_captcha_whitelist(self):
-        email = '[e-mail]'
-        pattern = '^canonicaltest(?:\+.+)?@gmail\.com$'
-        with self.settings(EMAIL_WHITELIST_REGEXP_LIST=[pattern]):
-            response = self.post_new_account(email=email)
-            self.assertEqual(response.status_code, self.success_status)
-
-    def test_new_account_captcha_whitelist_with_uuid(self):
-        email = '[e-mail]'
-        pattern = '^canonicaltest(?:\+.+)?@gmail\.com$'
-        with self.settings(EMAIL_WHITELIST_REGEXP_LIST=[pattern]):
-            response = self.post_new_account(email=email)
-            self.assertEqual(response.status_code, self.success_status)
-
-    def test_new_account_captcha_whitelist_fail(self):
-        email = '[e-mail]'
-        pattern = '^canonicaltest(?:\+.+)?@gmail\.com$'
-        with self.settings(EMAIL_WHITELIST_REGEXP_LIST=[pattern]):
-            response = self.post_new_account(email=email)
-            msg = 'It appears that our captcha service was unable to load'
-            self.assertContains(response, msg)
-
-    @patch.object(Captcha, '_open')
-    def test_uses_timeline_from_request(self, mock_open):
-        mock_open.return_value = CaptchaResponse(200, StringIO('true\na'))
-        request = Mock()
-        timeline = Timeline()
-        request.META = {'timeline.timeline': timeline}
-        request.POST = {'recaptcha_challenge_field': 'captcha-id'}
-        request.environ = {'REMOTE_ADDR': '127.0.0.1'}
-        ui._verify_captcha_response(None, request, None)
-        self.assertEqual(1, len(timeline.actions))
-        self.assertEqual('captcha-verify', timeline.actions[0].category)
-
-
 class CookiesTestCase(SSOBaseTestCase):
 
     def setUp(self):

=== modified file 'src/webui/views/registration.py'
--- src/webui/views/registration.py	2018-05-28 20:15:33 +0000
+++ src/webui/views/registration.py	2018-10-16 20:29:23 +0000
@@ -53,7 +53,6 @@
     requires_cookies,
 )
 from webui.views.utils import (
-    add_captcha_settings,
     display_email_sent,
     set_session_email,
 )
@@ -87,10 +86,6 @@
 @requires_cookies
 @require_http_methods(['GET', 'POST'])
 def new_account(request, token=None):
-    captcha_required = (gargoyle.is_active('CAPTCHA', request) and
-                        gargoyle.is_active('CAPTCHA_NEW_ACCOUNT', request))
-    captcha_error = ''
-    captcha_error_message = None
     rpconfig = get_rpconfig_from_request(request, token)
 
     def collect_stats(key):
@@ -108,14 +103,7 @@
             data = dict((k, v) for k, v in form.cleaned_data.items()
                         if k in ('email', 'password', 'displayname',
                                  'username'))
-            data['captcha_id'] = request.POST.get(
-                'recaptcha_challenge_field'
-            )
-            data['captcha_solution'] = request.POST.get(
-                'recaptcha_response_field'
-            )
             # we'll handle our own capture generation
-            data['create_captcha'] = False
             data['creation_source'] = WEB_CREATION_SOURCE
             if token:
                 data['oid_token'] = token
@@ -136,15 +124,6 @@
                 collect_stats('error.email')
                 form._errors['email'] = [VERIFY_EMAIL_MESSAGE]
 
-            except api_errors.CaptchaRequired as e:
-                captcha_required = True
-                collect_stats('captcha_required')
-
-            except (api_errors.CaptchaFailure, api_errors.CaptchaError) as e:
-                captcha_required = True
-                captcha_error = '&error=' + e.extra.get('captcha_message', '')
-                captcha_error_message = _('Incorrect captcha solution')
-                collect_stats('error.captcha')
             except Exception as e:
                 return HttpResponseServerError("exception: " + str(e))
             else:
@@ -175,12 +154,7 @@
         'form': form,
         'rpconfig': rpconfig,
         'token': token,
-        'captcha_required': captcha_required,
-        'captcha_error': captcha_error,
-        'captcha_error_message': captcha_error_message,
     }
-    if captcha_required:
-        context = add_captcha_settings(context)
 
     if form.errors:
         err = form.errors.get('email', [''])[0]

=== modified file 'src/webui/views/ui.py'
--- src/webui/views/ui.py	2018-08-24 15:30:53 +0000
+++ src/webui/views/ui.py	2018-10-16 20:29:23 +0000
@@ -56,11 +56,7 @@
 
 )
 from identityprovider.models import twofactor
-from identityprovider.models.captcha import (
-    Captcha,
-    CaptchaV2,
-    VerifyCaptchaError
-)
+from identityprovider.models.captcha import CaptchaV2
 from identityprovider.models.const import AccountStatus, AuthTokenType
 from identityprovider.signals import login_failed, login_succeeded
 from identityprovider.signed import BadSignedValue
@@ -94,7 +90,6 @@
     requires_cookies,
 )
 from webui.views import registration
-from webui.views.utils import add_captcha_settings
 
 
 ACCOUNT_CREATED = _("Your account was created successfully")
@@ -150,11 +145,6 @@
             self, request, token, rpconfig, form, create_account_form=None):
         context = super(LoginView, self).get_context(
             request, token=token, rpconfig=rpconfig, form=form)
-        # add captcha and account creation form
-        context['captcha_required'] = (
-            gargoyle.is_active('CAPTCHA', request) and
-            gargoyle.is_active('CAPTCHA_NEW_ACCOUNT', request))
-        context = add_captcha_settings(context)
         context['create_account_form'] = create_account_form
         return context
 
@@ -503,30 +493,6 @@
     return registration.new_account(request, token)
 
 
-def _verify_captcha_response(template, request, form):
-    captcha = Captcha(request.POST.get('recaptcha_challenge_field'))
-    captcha_solution = request.POST.get('recaptcha_response_field')
-    email = request.POST.get('email', '')
-    ip_addr = request.environ["REMOTE_ADDR"]
-    try:
-        timer_fn = get_request_timing_function(request)
-        verified = captcha.verify(captcha_solution, ip_addr, email,
-                                  timer=timer_fn)
-        if verified:
-            return None
-    except VerifyCaptchaError:
-        logger.exception("reCaptcha connection error")
-
-    # not verified
-    return render(
-        request,
-        template,
-        add_captcha_settings({
-            'form': form,
-            'captcha_error': ('&error=%s' % captcha.message),
-            'captcha_required': True}))
-
-
 @require_twofactor_authenticated(
     _("Please log in to use this confirmation code"))
 def confirm_email(request, authtoken, email_address, token=None):

=== modified file 'src/webui/views/utils.py'
--- src/webui/views/utils.py	2015-05-08 19:25:27 +0000
+++ src/webui/views/utils.py	2018-10-16 20:29:23 +0000
@@ -43,10 +43,3 @@
 def set_session_email(session, email):
     """Place information about the current token's email in the session"""
     session['token_email'] = email
-
-
-def add_captcha_settings(context):
-    d = {'CAPTCHA_PUBLIC_KEY': settings.CAPTCHA_PUBLIC_KEY,
-         'CAPTCHA_API_URL_SECURE': settings.CAPTCHA_API_URL_SECURE}
-    d.update(context)
-    return d