Add arkose fail open counters

What does this MR do and why?

This MR adds code for counting the failures and successes of the Arkose::TokenVerificationService. In a future MR, these counts will be used to determine whether we should activate our fail open mechanism.

References

#578300

Setup Instructions

  1. Setup Arkose (get credentials via 1Password)
# rails c

::Gitlab::CurrentSettings.update!(arkose_labs_public_api_key: ', arkose_labs_private_api_key: '', arkose_labs_namespace: 'client')
::Gitlab::CurrentSettings.update!(arkose_labs_data_exchange_key: "")
  1. Enable the feature flag
# rails c

Feature.enable(:track_arkose_token_verification_results, :instance)
  1. Verify counters work correctly:
# rails c

mod = AntiAbuse::IdentityVerification::ArkoseFailOpen

# Bump SUCCESS 3x
mod.track_token_verification_result(success: true)
mod.track_token_verification_result(success: true)
mod.track_token_verification_result(success: true)

# Bump FAILURE 2x
mod.track_token_verification_result(success: false)
mod.track_token_verification_result(success: false)

h   = mod::BUCKET_DURATION_HOURS
now = Time.zone.now
id  = "#{now.to_date.strftime('%Y%m%d')}-#{now.hour / h}"

sp = mod::COUNTER_SUCCESS_KEY_PREFIX
fp = mod::COUNTER_FAILURE_KEY_PREFIX

Gitlab::Redis::SharedState.with do |r|
  sk, fk   = "#{sp}#{id}", "#{fp}#{id}"
  s,  f    = r.get(sk)&.to_i || 0, r.get(fk)&.to_i || 0
  sttl,fttl= r.ttl(sk), r.ttl(fk)

  puts "bucket=#{id}\n  success: #{s} (ttl=#{sttl}s) key=#{sk}\n  failure: #{f} (ttl=#{fttl}s) key=#{fk}"
end

# =>
# bucket=20251105-5
#  success: 3 (ttl=28785s) key=arkose:vrate:success:20251105-5
#  failure: 2 (ttl=28785s) key=arkose:vrate:failure:20251105-5
Edited by Matthew MacRae-Bovell

Merge request reports

Loading