From 1eee4f9c8948a65089571b741e11b0c9d1868691 Mon Sep 17 00:00:00 2001
From: Kevin Masters <135744319+kevinsmaster5@users.noreply.github.com>
Date: Thu, 7 Mar 2024 12:51:08 -0500
Subject: [PATCH 01/13] LG-12465 VPAT 1.1.1 Safari VoiceOver svg with null alt
 (#10200)

* changelog: Bug Fixes, Accessibility, Safari use of VoiceOver reading alt=null images

* add ability to check for role in svg

* change role from 'img' to 'presentation'

* reset role to img

* revert test for svg role

* fix lint

* add skipping method to axe_clean violation test

* make axe exclude more specific

* add comment explaining exclude matcher
---
 app/components/badge_component.html.erb       |  2 +-
 app/views/mfa_confirmation/show.html.erb      |  2 +-
 .../openid_connect/logout/index.html.erb      |  2 +-
 .../_mfa_selection.html.erb                   |  2 +-
 app/views/shared/_footer_lite.html.erb        |  2 +-
 .../_sp_registration_heading.html.erb         |  2 +-
 .../users/backup_code_setup/reminder.html.erb |  2 +-
 app/views/users/webauthn_setup/new.html.erb   |  2 +-
 spec/support/matchers/accessibility.rb        | 30 ++++++++++++++++++-
 9 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/app/components/badge_component.html.erb b/app/components/badge_component.html.erb
index da8b6c8a2ed..4514b4de4d3 100644
--- a/app/components/badge_component.html.erb
+++ b/app/components/badge_component.html.erb
@@ -1,4 +1,4 @@
 <%= content_tag('div', **tag_options, class: ['lg-verification-badge', *tag_options[:class]]) do %>
-  <%= image_tag(asset_path("alerts/#{icon}.svg"), size: 16, alt: '') %>
+  <%= image_tag(asset_path("alerts/#{icon}.svg"), size: 16, alt: '', role: 'img') %>
   <%= content %>
 <% end %>
diff --git a/app/views/mfa_confirmation/show.html.erb b/app/views/mfa_confirmation/show.html.erb
index fca5ca3d3b6..d88f2569c95 100644
--- a/app/views/mfa_confirmation/show.html.erb
+++ b/app/views/mfa_confirmation/show.html.erb
@@ -1,6 +1,6 @@
 <% self.title = @content.heading %>
 
-<%= image_tag asset_url('user-signup-ial1.svg'), width: 107, height: 119, alt: '', class: 'margin-bottom-4' %>
+<%= image_tag asset_url('user-signup-ial1.svg'), width: 107, height: 119, alt: '', class: 'margin-bottom-4', role: 'img' %>
 
 <%= render PageHeadingComponent.new.with_content(@content.heading) %>
 
diff --git a/app/views/openid_connect/logout/index.html.erb b/app/views/openid_connect/logout/index.html.erb
index f0f46059050..0e474590447 100644
--- a/app/views/openid_connect/logout/index.html.erb
+++ b/app/views/openid_connect/logout/index.html.erb
@@ -1,7 +1,7 @@
 <% self.title = t('openid_connect.logout.heading', app_name: APP_NAME) %>
 
 <div class='text-center'>
-  <%= image_tag(asset_url('user-access.svg'), width: '280', height: '91', alt: '') %>
+  <%= image_tag(asset_url('user-access.svg'), width: '280', height: '91', alt: '', role: 'img') %>
   <% if @service_provider_name.present? %>
     <%= render PageHeadingComponent.new.with_content(t('openid_connect.logout.heading_with_sp', app_name: APP_NAME, service_provider_name: @service_provider_name)) %>
   <% else %>
diff --git a/app/views/partials/multi_factor_authentication/_mfa_selection.html.erb b/app/views/partials/multi_factor_authentication/_mfa_selection.html.erb
index 6487e7c0f9a..e3cb61b1605 100644
--- a/app/views/partials/multi_factor_authentication/_mfa_selection.html.erb
+++ b/app/views/partials/multi_factor_authentication/_mfa_selection.html.erb
@@ -17,7 +17,7 @@
       "two_factor_options_form_selection_#{option.type}",
       class: 'usa-checkbox__label usa-checkbox__label--illustrated',
     ) do %>
-  <%= image_tag(asset_url("mfa-options/#{option.type}.svg"), alt: '', class: 'usa-checkbox__image') %>
+  <%= image_tag(asset_url("mfa-options/#{option.type}.svg"), alt: '', class: 'usa-checkbox__image', role: 'img') %>
   <div class="usa-checkbox__label--text">
     <span class="margin-right-2"><%= option.label %></span>
     <%= content_tag(
diff --git a/app/views/shared/_footer_lite.html.erb b/app/views/shared/_footer_lite.html.erb
index 6a312801634..9576aa184e0 100644
--- a/app/views/shared/_footer_lite.html.erb
+++ b/app/views/shared/_footer_lite.html.erb
@@ -1,6 +1,6 @@
 <footer class="footer">
   <%= new_tab_link_to('https://www.gsa.gov', class: 'display-none tablet:display-inline') do %>
-    <%= image_tag(asset_url('sp-logos/square-gsa.svg'), size: 20, alt: '', class: 'float-left margin-right-1') %>
+    <%= image_tag(asset_url('sp-logos/square-gsa.svg'), size: 20, alt: '', class: 'float-left margin-right-1', role: 'img') %>
     <%= t('shared.footer_lite.gsa') %>
   <% end %>
   <%= render LanguagePickerComponent.new(class: 'footer__language-picker') %>
diff --git a/app/views/sign_up/registrations/_sp_registration_heading.html.erb b/app/views/sign_up/registrations/_sp_registration_heading.html.erb
index 1bebb5e7078..4de0f5ba94f 100644
--- a/app/views/sign_up/registrations/_sp_registration_heading.html.erb
+++ b/app/views/sign_up/registrations/_sp_registration_heading.html.erb
@@ -1,5 +1,5 @@
 <div class="text-center">
-  <%= image_tag(asset_url('user-access.svg'), width: '280', height: '91', alt: '') %>
+  <%= image_tag(asset_url('user-access.svg'), width: '280', height: '91', alt: '', role: 'img') %>
   <h1 class="margin-bottom-4 text-primary text-normal">
     <strong><%= decorated_sp_session.sp_name %></strong>
     <%= t('headings.create_account_with_sp.sp_text', app_name: APP_NAME) %>
diff --git a/app/views/users/backup_code_setup/reminder.html.erb b/app/views/users/backup_code_setup/reminder.html.erb
index 6f1a22d1750..3a12ba1af86 100644
--- a/app/views/users/backup_code_setup/reminder.html.erb
+++ b/app/views/users/backup_code_setup/reminder.html.erb
@@ -1,6 +1,6 @@
 <% self.title = t('forms.backup_code.title') %>
 
-<%= image_tag asset_url('user-signup-ial1.svg'), width: 107, height: 119, alt: '', class: 'margin-bottom-4' %>
+<%= image_tag asset_url('user-signup-ial1.svg'), width: 107, height: 119, alt: '', class: 'margin-bottom-4', role: 'img' %>
 
 <%= render PageHeadingComponent.new.with_content(t('forms.backup_code_reminder.heading')) %>
 
diff --git a/app/views/users/webauthn_setup/new.html.erb b/app/views/users/webauthn_setup/new.html.erb
index 9259894c03f..f0eee7961fc 100644
--- a/app/views/users/webauthn_setup/new.html.erb
+++ b/app/views/users/webauthn_setup/new.html.erb
@@ -1,6 +1,6 @@
 <% self.title = @presenter.page_title %>
 
-<%= image_tag asset_url(@presenter.image_path), alt: '', width: '90', class: 'margin-left-1 margin-bottom-2' %>
+<%= image_tag asset_url(@presenter.image_path), alt: '', width: '90', class: 'margin-left-1 margin-bottom-2', role: 'img' %>
 
 <%= render PageHeadingComponent.new.with_content(@presenter.heading) %>
 
diff --git a/spec/support/matchers/accessibility.rb b/spec/support/matchers/accessibility.rb
index 19659c2b50c..b9e295ecc66 100644
--- a/spec/support/matchers/accessibility.rb
+++ b/spec/support/matchers/accessibility.rb
@@ -170,6 +170,27 @@ def landmarks(page)
   end
 end
 
+RSpec::Matchers.define :tag_decorative_svgs_with_role do
+  def decorative_svgs(page)
+    page.all(:css, 'img[alt=""][src$=".svg" i]')
+  end
+
+  match do |page|
+    expect(decorative_svgs(page)).to all satisfy { |img| img[:role] == 'img' }
+  end
+
+  failure_message do |page|
+    img_tags = decorative_svgs(page).reject { |img| img[:role] == 'img' }.
+      map { |img| %(<img alt="#{img[:alt]}" src="#{img[:src]}" class="#{img[:class]}">) }.
+      join("\n")
+
+    <<~STR
+      Expect all decorative SVGs to have role="img", but found ones without:
+      #{img_tags}
+    STR
+  end
+end
+
 class AccessibleName
   attr_reader :page
 
@@ -289,10 +310,17 @@ def fieldset_legend_name(element)
 end
 
 def expect_page_to_have_no_accessibility_violations(page, validate_markup: true)
-  expect(page).to be_axe_clean.according_to :section508, :"best-practice", :wcag21aa
+  expect(page).to be_axe_clean.according_to(
+    :section508, :"best-practice",
+    :wcag21aa
+  ).
+    # Axe flags redundant img role on img elements, but is necessary for a Safari bug
+    # See: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/img#identifying_svg_as_an_image
+    excluding('img[alt=""][src$=".svg" i]')
   expect(page).to have_valid_idrefs
   expect(page).to label_required_fields
   expect(page).to have_valid_markup if validate_markup
+  expect(page).to tag_decorative_svgs_with_role
 end
 
 def activate_skip_link

From ddf78f0bfa51cfa1408924501d6e4fb819092fff Mon Sep 17 00:00:00 2001
From: Andrew Duthie <1779930+aduth@users.noreply.github.com>
Date: Thu, 7 Mar 2024 15:03:21 -0500
Subject: [PATCH 02/13] Upgrade Login.gov Design System to v9.0 (#10210)

* Upgrade Login.gov Design System to v9.0

* Add changelog

changelog: Internal, Dependencies, Update dependencies to latest versions
---
 .../packages/clipboard-button/package.json         |  2 +-
 app/javascript/packs/navigation.ts                 |  4 ++--
 .../_mfa_selection.html.erb                        |  2 +-
 package.json                                       |  2 +-
 yarn.lock                                          | 14 ++++++++++----
 5 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/app/javascript/packages/clipboard-button/package.json b/app/javascript/packages/clipboard-button/package.json
index 31a34e15293..0d8a3265721 100644
--- a/app/javascript/packages/clipboard-button/package.json
+++ b/app/javascript/packages/clipboard-button/package.json
@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "private": true,
   "dependencies": {
-    "@18f/identity-design-system": "^8.1.2"
+    "@18f/identity-design-system": "^9.0.0"
   },
   "sideEffects": [
     "./clipboard-button-element.ts"
diff --git a/app/javascript/packs/navigation.ts b/app/javascript/packs/navigation.ts
index 804c024e86a..7452da5aaa3 100644
--- a/app/javascript/packs/navigation.ts
+++ b/app/javascript/packs/navigation.ts
@@ -1,3 +1,3 @@
-import { header } from '@18f/identity-design-system';
+import { navigation } from '@18f/identity-design-system';
 
-header.on();
+navigation.on();
diff --git a/app/views/partials/multi_factor_authentication/_mfa_selection.html.erb b/app/views/partials/multi_factor_authentication/_mfa_selection.html.erb
index e3cb61b1605..17cf08c79a4 100644
--- a/app/views/partials/multi_factor_authentication/_mfa_selection.html.erb
+++ b/app/views/partials/multi_factor_authentication/_mfa_selection.html.erb
@@ -23,7 +23,7 @@
     <%= content_tag(
           :span,
           id: "two_factor_options_form_selection_description_#{option.type}",
-          class: option.mfa_configuration_description.presence && 'usa-tag bg-green',
+          class: option.mfa_configuration_description.presence && 'usa-tag bg-success',
           aria: { hidden: true },
         ) do %>
       <%= option.mfa_configuration_description %>
diff --git a/package.json b/package.json
index b6af7717477..0fdce421c18 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
     "build:css": "build-sass app/assets/stylesheets/*.css.scss app/components/*.scss --load-path=app/assets/stylesheets --out-dir=app/assets/builds"
   },
   "dependencies": {
-    "@18f/identity-design-system": "^8.1.2",
+    "@18f/identity-design-system": "^9.0.0",
     "@babel/core": "^7.20.7",
     "@babel/preset-env": "^7.15.6",
     "@babel/preset-react": "^7.14.5",
diff --git a/yarn.lock b/yarn.lock
index 87d56d37124..5b1834aa016 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2,11 +2,12 @@
 # yarn lockfile v1
 
 
-"@18f/identity-design-system@^8.1.2":
-  version "8.1.2"
-  resolved "https://registry.yarnpkg.com/@18f/identity-design-system/-/identity-design-system-8.1.2.tgz#d9f36e50c615afb4ff81befe02309a618647bd33"
-  integrity sha512-EvhnRvqOWmvjAdV2EedvSeoiN55RFA4RqAIsPTScw1N6QstbXEzJmDA242k3X81nf6Kd1yRFKxrKxNdl1CbmDQ==
+"@18f/identity-design-system@^9.0.0":
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/@18f/identity-design-system/-/identity-design-system-9.0.0.tgz#d10756f79371fc379a0c45fb7517eb59325acd04"
+  integrity sha512-l1cdTlp6lHRnWypqDkXCDAfkQMGbgaU1LicLyNXxDZ5sAMskGxfR1dKC5Igt/JL05XbBs2kBzyLW/UHs+KkMow==
   dependencies:
+    "@types/uswds__uswds" "^3.7.0"
     "@uswds/uswds" "^3.7.1"
 
 "@aashutoshrathi/word-wrap@^1.2.3":
@@ -1717,6 +1718,11 @@
   dependencies:
     "@types/react-test-renderer" "*"
 
+"@types/uswds__uswds@^3.7.0":
+  version "3.7.0"
+  resolved "https://registry.yarnpkg.com/@types/uswds__uswds/-/uswds__uswds-3.7.0.tgz#6ce7b3dbff304113f4e7acaa88fff4c771dfb02d"
+  integrity sha512-HlOhwJPLpmv3rC8IN81DmvnRvi9Qzsf7MdxlE1XCB+fsPqTakkrpLdDoQOL+9lcCOurt7VhBXClSi6ZCKskZHw==
+
 "@types/wrap-ansi@^3.0.0":
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/@types/wrap-ansi/-/wrap-ansi-3.0.0.tgz#18b97a972f94f60a679fd5c796d96421b9abb9fd"

From b456d8556fc684179c015e818539cd3082574ad7 Mon Sep 17 00:00:00 2001
From: Andrew Duthie <1779930+aduth@users.noreply.github.com>
Date: Fri, 8 Mar 2024 10:12:15 -0500
Subject: [PATCH 03/13] Remove unnecessary background styles from language
 picker (#10217)

changelog: Internal, Code Quality, Remove unnecessary background styles from language picker
---
 app/assets/stylesheets/components/_language-picker.scss | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/app/assets/stylesheets/components/_language-picker.scss b/app/assets/stylesheets/components/_language-picker.scss
index 39c43f5755a..2b58f3d680c 100644
--- a/app/assets/stylesheets/components/_language-picker.scss
+++ b/app/assets/stylesheets/components/_language-picker.scss
@@ -22,11 +22,7 @@
 .language-picker__label {
   align-items: center;
   display: flex;
-  background-position: right units(1.5) center;
-  background-position-y: calc(50% + 2px);
-  padding: units(0.5);
-  padding-left: units(1);
-  padding-right: units(1);
+  padding: units(0.5) units(1);
   border-color: transparent;
 
   @include at-media-max('tablet') {

From d540121ca00697453faca9daef9f4778638f1db1 Mon Sep 17 00:00:00 2001
From: Andrew Duthie <1779930+aduth@users.noreply.github.com>
Date: Fri, 8 Mar 2024 12:16:26 -0500
Subject: [PATCH 04/13] Clean PIV session detail after deletion (#10220)

changelog: Bug Fixes, PIV/CAC, Consistently clear PIV session detail after deletion
---
 .../two_factor_authentication/piv_cac_controller.rb         | 2 ++
 .../two_factor_authentication/piv_cac_controller_spec.rb    | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/app/controllers/api/internal/two_factor_authentication/piv_cac_controller.rb b/app/controllers/api/internal/two_factor_authentication/piv_cac_controller.rb
index 4a08b0d74a5..ff59834032f 100644
--- a/app/controllers/api/internal/two_factor_authentication/piv_cac_controller.rb
+++ b/app/controllers/api/internal/two_factor_authentication/piv_cac_controller.rb
@@ -4,6 +4,7 @@ module TwoFactorAuthentication
       class PivCacController < ApplicationController
         include CsrfTokenConcern
         include ReauthenticationRequiredConcern
+        include PivCacConcern
 
         before_action :render_unauthorized, unless: :recently_authenticated_2fa?
 
@@ -38,6 +39,7 @@ def destroy
             create_user_event(:piv_cac_disabled)
             revoke_remember_device(current_user)
             deliver_push_notification
+            clear_piv_cac_information
             render json: { success: true }
           else
             render json: { success: false, error: result.first_error_message }, status: :bad_request
diff --git a/spec/controllers/api/internal/two_factor_authentication/piv_cac_controller_spec.rb b/spec/controllers/api/internal/two_factor_authentication/piv_cac_controller_spec.rb
index 91c238740e4..d3dd64b9400 100644
--- a/spec/controllers/api/internal/two_factor_authentication/piv_cac_controller_spec.rb
+++ b/spec/controllers/api/internal/two_factor_authentication/piv_cac_controller_spec.rb
@@ -142,6 +142,12 @@
       end
     end
 
+    it 'removes the piv/cac information from the user session' do
+      controller.user_session[:decrypted_x509] = {}
+      response
+      expect(controller.user_session[:decrypted_x509]).to be_nil
+    end
+
     it 'logs a user event for the removed credential' do
       expect { response }.to change { user.events.piv_cac_disabled.size }.by 1
     end

From 704f45c056e509e9da84a05a3332443d7d19d00b Mon Sep 17 00:00:00 2001
From: Charley Ferguson <charleyferguson@navapbc.com>
Date: Fri, 8 Mar 2024 13:41:27 -0500
Subject: [PATCH 05/13] LG-12160: FE Logging Changes (#10156)

* Note the places for addition

* Add FE logging and fix existing tests

* changelog: Internal, In-Person Proofing, Add FE logging for liveness_check_required

* test commit

* Add to FE logs

* Add additional FE events

* Remove unnessecary change - liveness_checking_required is already included in response

* Add `liveness_checking_required` to more FE events

* Add new value to tests

* Fix missing argument

* Remove duplicate param doc

* Lint fixes

* Use the new SelfieCaptureContext

* Update events to include "image added" events

* Document events to fix lint problem
---
 .../components/acuant-capture.tsx             | 11 ++++++-
 .../components/barcode-attention-warning.tsx  | 11 +++++--
 .../components/document-capture-warning.tsx   |  3 ++
 .../components/review-issues-step.tsx         |  6 +++-
 .../document-capture/context/acuant.tsx       |  4 +++
 app/services/analytics_events.rb              | 32 +++++++++++++++++--
 spec/features/idv/analytics_spec.rb           | 22 ++++++-------
 .../components/acuant-capture-spec.jsx        | 15 +++++++++
 .../document-capture-warning-spec.jsx         |  2 ++
 .../components/review-issues-step-spec.jsx    |  1 +
 .../document-capture/context/acuant-spec.jsx  |  3 ++
 11 files changed, 93 insertions(+), 17 deletions(-)

diff --git a/app/javascript/packages/document-capture/components/acuant-capture.tsx b/app/javascript/packages/document-capture/components/acuant-capture.tsx
index 40a739dab6a..b273f2e4e0f 100644
--- a/app/javascript/packages/document-capture/components/acuant-capture.tsx
+++ b/app/javascript/packages/document-capture/components/acuant-capture.tsx
@@ -22,6 +22,7 @@ import AcuantCaptureCanvas from './acuant-capture-canvas';
 import AcuantContext, { AcuantCaptureMode } from '../context/acuant';
 import AnalyticsContext from '../context/analytics';
 import DeviceContext from '../context/device';
+import SelfieCaptureContext from '../context/selfie-capture';
 import FailedCaptureAttemptsContext from '../context/failed-capture-attempts';
 import FileInput from './file-input';
 import UploadContext from '../context/upload';
@@ -320,6 +321,7 @@ function AcuantCapture(
   } = useContext(AcuantContext);
   const { isMockClient } = useContext(UploadContext);
   const { trackEvent } = useContext(AnalyticsContext);
+  const { isSelfieCaptureEnabled } = useContext(SelfieCaptureContext);
   const fullScreenRef = useRef<FullScreenRefHandle>(null);
   const inputRef = useRef<HTMLInputElement>(null);
   const isForceUploading = useRef(false);
@@ -382,6 +384,7 @@ function AcuantCapture(
       ...payload,
       captureAttempts,
       acuantCaptureMode: payload.source === 'upload' ? null : acuantCaptureMode,
+      liveness_checking_required: isSelfieCaptureEnabled,
     };
     incrementCaptureAttempts();
     return enhancedPayload;
@@ -424,7 +427,11 @@ function AcuantCapture(
     return <T extends (...args: any[]) => any>(fn: T) =>
       (...args: Parameters<T>) => {
         if (!isSuppressingClickLogging.current) {
-          trackEvent(`IdV: ${name} image clicked`, { source, ...metadata });
+          trackEvent(`IdV: ${name} image clicked`, {
+            source,
+            ...metadata,
+            liveness_checking_required: isSelfieCaptureEnabled,
+          });
         }
 
         return fn(...args);
@@ -591,6 +598,7 @@ function AcuantCapture(
       size: getDecodedBase64ByteSize(nextCapture.image.data),
       fingerprint: null,
       failedImageResubmission: false,
+      liveness_checking_required: false,
     });
 
     trackEvent(
@@ -655,6 +663,7 @@ function AcuantCapture(
       field: name,
       acuantCaptureMode,
       error: getNormalizedAcuantCaptureFailureMessage(error, code),
+      liveness_checking_required: isSelfieCaptureEnabled,
     });
   }
 
diff --git a/app/javascript/packages/document-capture/components/barcode-attention-warning.tsx b/app/javascript/packages/document-capture/components/barcode-attention-warning.tsx
index e6ff6ebfe4a..95265aa65da 100644
--- a/app/javascript/packages/document-capture/components/barcode-attention-warning.tsx
+++ b/app/javascript/packages/document-capture/components/barcode-attention-warning.tsx
@@ -1,9 +1,11 @@
 import { Button, StatusPage } from '@18f/identity-components';
 import { t } from '@18f/identity-i18n';
 import { trackEvent } from '@18f/identity-analytics';
+import { useContext } from 'react';
 import { removeUnloadProtection } from '@18f/identity-url';
 import type { PII } from '../services/upload';
 import DocumentCaptureTroubleshootingOptions from './document-capture-troubleshooting-options';
+import SelfieCaptureContext from '../context/selfie-capture';
 
 interface BarcodeAttentionWarningProps {
   /**
@@ -18,15 +20,20 @@ interface BarcodeAttentionWarningProps {
 }
 
 function BarcodeAttentionWarning({ onDismiss, pii }: BarcodeAttentionWarningProps) {
+  const { isSelfieCaptureEnabled } = useContext(SelfieCaptureContext);
   function skipAttention() {
-    trackEvent('IdV: barcode warning continue clicked');
+    trackEvent('IdV: barcode warning continue clicked', {
+      liveness_checking_required: isSelfieCaptureEnabled,
+    });
     removeUnloadProtection();
     const form = document.querySelector<HTMLFormElement>('.js-document-capture-form');
     form?.submit();
   }
 
   function handleDismiss() {
-    trackEvent('IdV: barcode warning retake photos clicked');
+    trackEvent('IdV: barcode warning retake photos clicked', {
+      liveness_checking_required: isSelfieCaptureEnabled,
+    });
     onDismiss();
   }
 
diff --git a/app/javascript/packages/document-capture/components/document-capture-warning.tsx b/app/javascript/packages/document-capture/components/document-capture-warning.tsx
index d9063a099a1..59636f30253 100644
--- a/app/javascript/packages/document-capture/components/document-capture-warning.tsx
+++ b/app/javascript/packages/document-capture/components/document-capture-warning.tsx
@@ -8,6 +8,7 @@ import DocumentCaptureTroubleshootingOptions from './document-capture-troublesho
 import UnknownError from './unknown-error';
 import { InPersonContext } from '../context';
 import AnalyticsContext from '../context/analytics';
+import SelfieCaptureContext from '../context/selfie-capture';
 
 interface DocumentCaptureWarningProps {
   isFailedDocType: boolean;
@@ -77,6 +78,7 @@ function DocumentCaptureWarning({
 }: DocumentCaptureWarningProps) {
   const { t } = useI18n();
   const { inPersonURL } = useContext(InPersonContext);
+  const { isSelfieCaptureEnabled } = useContext(SelfieCaptureContext);
   const { trackEvent } = useContext(AnalyticsContext);
 
   const nonIppOrFailedResult = !inPersonURL || isFailedResult;
@@ -109,6 +111,7 @@ function DocumentCaptureWarning({
       heading,
       subheading: subheadingText,
       error_message_displayed: errorMessageDisplayed,
+      liveness_checking_required: isSelfieCaptureEnabled,
     });
   }, []);
 
diff --git a/app/javascript/packages/document-capture/components/review-issues-step.tsx b/app/javascript/packages/document-capture/components/review-issues-step.tsx
index 9402308edc9..cf47bda15fd 100644
--- a/app/javascript/packages/document-capture/components/review-issues-step.tsx
+++ b/app/javascript/packages/document-capture/components/review-issues-step.tsx
@@ -6,6 +6,7 @@ import type { PII } from '../services/upload';
 import AnalyticsContext from '../context/analytics';
 import BarcodeAttentionWarning from './barcode-attention-warning';
 import FailedCaptureAttemptsContext from '../context/failed-capture-attempts';
+import SelfieCaptureContext from '../context/selfie-capture';
 import DocumentCaptureWarning from './document-capture-warning';
 import DocumentCaptureReviewIssues from './document-capture-review-issues';
 
@@ -64,6 +65,7 @@ function ReviewIssuesStep({
   failedImageFingerprints = { front: [], back: [] },
 }: ReviewIssuesStepProps) {
   const { trackEvent } = useContext(AnalyticsContext);
+  const { isSelfieCaptureEnabled } = useContext(SelfieCaptureContext);
   const [hasDismissed, setHasDismissed] = useState(remainingSubmitAttempts === Infinity);
   const { onPageTransition, changeStepCanComplete } = useContext(FormStepsContext);
   const [skipWarning, setSkipWarning] = useState(false);
@@ -100,7 +102,9 @@ function ReviewIssuesStep({
   }, []);
 
   function onWarningPageDismissed() {
-    trackEvent('IdV: Capture troubleshooting dismissed');
+    trackEvent('IdV: Capture troubleshooting dismissed', {
+      liveness_checking_required: isSelfieCaptureEnabled,
+    });
 
     setHasDismissed(true);
   }
diff --git a/app/javascript/packages/document-capture/context/acuant.tsx b/app/javascript/packages/document-capture/context/acuant.tsx
index 98be69c8c04..b3781ab67ba 100644
--- a/app/javascript/packages/document-capture/context/acuant.tsx
+++ b/app/javascript/packages/document-capture/context/acuant.tsx
@@ -3,6 +3,7 @@ import type { ReactNode } from 'react';
 import useObjectMemo from '@18f/identity-react-hooks/use-object-memo';
 import AnalyticsContext from './analytics';
 import DeviceContext from './device';
+import SelfieCaptureContext from './selfie-capture';
 
 /**
  * Global declarations
@@ -221,6 +222,7 @@ function AcuantContextProvider({
 }: AcuantContextProviderProps) {
   const { isMobile } = useContext(DeviceContext);
   const { trackEvent } = useContext(AnalyticsContext);
+  const { isSelfieCaptureEnabled } = useContext(SelfieCaptureContext);
   // Only mobile devices should load the Acuant SDK. Consider immediately ready otherwise.
   const [isReady, setIsReady] = useState(!isMobile);
   const [isAcuantLoaded, setIsAcuantLoaded] = useState(false);
@@ -275,6 +277,7 @@ function AcuantContextProvider({
             trackEvent('IdV: Acuant SDK loaded', {
               success: true,
               isCameraSupported: nextIsCameraSupported,
+              liveness_checking_required: isSelfieCaptureEnabled,
             });
 
             setIsCameraSupported(nextIsCameraSupported);
@@ -287,6 +290,7 @@ function AcuantContextProvider({
             success: false,
             code,
             description,
+            liveness_checking_required: isSelfieCaptureEnabled,
           });
 
           setIsError(true);
diff --git a/app/services/analytics_events.rb b/app/services/analytics_events.rb
index 2a786e534f4..697feb9fe0d 100644
--- a/app/services/analytics_events.rb
+++ b/app/services/analytics_events.rb
@@ -612,6 +612,7 @@ def fraud_review_rejected(
   # @param [Boolean] isCameraSupported
   # @param [Boolean] success
   # @param [Boolean] use_alternate_sdk
+  # @param [Boolean] liveness_checking_required
   # The Acuant SDK was loaded
   # rubocop:disable Naming/VariableName,Naming/MethodParameterName
   def idv_acuant_sdk_loaded(
@@ -621,6 +622,7 @@ def idv_acuant_sdk_loaded(
     isCameraSupported:,
     success:,
     use_alternate_sdk:,
+    liveness_checking_required:,
     **_extra
   )
     track_event(
@@ -631,6 +633,7 @@ def idv_acuant_sdk_loaded(
       isCameraSupported: isCameraSupported,
       success: success,
       use_alternate_sdk: use_alternate_sdk,
+      liveness_checking_required: liveness_checking_required,
     )
   end
   # rubocop:enable Naming/VariableName,Naming/MethodParameterName
@@ -689,6 +692,7 @@ def idv_address_visit
   # @param [Integer] size size of image added in bytes
   # @param [String] source
   # @param [Boolean] use_alternate_sdk
+  # @param [String] liveness_checking_required Whether or not the selfie is required
   # @param [Integer] width width of image added in pixels
   # Back image was added in document capture
   # rubocop:disable Naming/VariableName,Naming/MethodParameterName
@@ -716,6 +720,7 @@ def idv_back_image_added(
     size:,
     source:,
     use_alternate_sdk:,
+    liveness_checking_required:,
     width:,
     **_extra
   )
@@ -744,6 +749,7 @@ def idv_back_image_added(
       size: size,
       source: source,
       use_alternate_sdk: use_alternate_sdk,
+      liveness_checking_required: liveness_checking_required,
       width: width,
     )
   end
@@ -754,6 +760,7 @@ def idv_back_image_added(
   # @param [Boolean] isDrop
   # @param [Boolean] source
   # @param [Boolean] use_alternate_sdk
+  # @param [String] liveness_checking_required Whether or not the selfie is required
   def idv_back_image_clicked(
     acuant_sdk_upgrade_a_b_testing_enabled:,
     acuant_version:,
@@ -761,6 +768,7 @@ def idv_back_image_clicked(
     isDrop:,
     source:,
     use_alternate_sdk:,
+    liveness_checking_required:,
     **_extra
   )
     track_event(
@@ -771,19 +779,24 @@ def idv_back_image_clicked(
       isDrop: isDrop,
       source: source,
       use_alternate_sdk: use_alternate_sdk,
+      liveness_checking_required: liveness_checking_required,
     )
   end
   # rubocop:enable Naming/VariableName,Naming/MethodParameterName
 
-  def idv_barcode_warning_continue_clicked(**_extra)
+  # @param [String] liveness_checking_required Whether or not the selfie is required
+  def idv_barcode_warning_continue_clicked(liveness_checking_required:, **_extra)
     track_event(
       'Frontend: IdV: barcode warning continue clicked',
+      liveness_checking_required: liveness_checking_required,
     )
   end
 
-  def idv_barcode_warning_retake_photos_clicked(**_extra)
+  # @param [String] liveness_checking_required Whether or not the selfie is required
+  def idv_barcode_warning_retake_photos_clicked(liveness_checking_required:, **_extra)
     track_event(
       'Frontend: IdV: barcode warning retake photos clicked',
+      liveness_checking_required: liveness_checking_required,
     )
   end
 
@@ -835,11 +848,13 @@ def idv_cancellation_visited(
   # @param [String] acuant_version
   # @param [String] flow_path whether the user is in the hybrid or standard flow
   # @param [String] use_alternate_sdk
+  # @param [Boolean] liveness_checking_required
   def idv_capture_troubleshooting_dismissed(
     acuant_sdk_upgrade_a_b_testing_enabled:,
     acuant_version:,
     flow_path:,
     use_alternate_sdk:,
+    liveness_checking_required:,
     **_extra
   )
     track_event(
@@ -848,6 +863,7 @@ def idv_capture_troubleshooting_dismissed(
       acuant_version: acuant_version,
       flow_path: flow_path,
       use_alternate_sdk: use_alternate_sdk,
+      liveness_checking_required: liveness_checking_required,
     )
   end
 
@@ -1347,6 +1363,7 @@ def idv_forgot_password_confirmed(proofing_components: nil, **extra)
   # @param [Integer] size size of image added in bytes
   # @param [String] source
   # @param [Boolean] use_alternate_sdk
+  # @param [String] liveness_checking_required Whether or not the selfie is required
   # @param [Integer] width width of image added in pixels
   # Front image was added in document capture
   # rubocop:disable Naming/VariableName,Naming/MethodParameterName
@@ -1374,6 +1391,7 @@ def idv_front_image_added(
     size:,
     source:,
     use_alternate_sdk:,
+    liveness_checking_required:,
     width:,
     **_extra
   )
@@ -1402,6 +1420,7 @@ def idv_front_image_added(
       size: size,
       source: source,
       use_alternate_sdk: use_alternate_sdk,
+      liveness_checking_required: liveness_checking_required,
       width: width,
     )
   end
@@ -1412,6 +1431,7 @@ def idv_front_image_added(
   # @param [Boolean] isDrop
   # @param [String] source
   # @param [String] use_alternate_sdk
+  # @param [Boolean] liveness_checking_required
   def idv_front_image_clicked(
     acuant_sdk_upgrade_a_b_testing_enabled:,
     acuant_version:,
@@ -1419,6 +1439,7 @@ def idv_front_image_clicked(
     isDrop:,
     source:,
     use_alternate_sdk:,
+    liveness_checking_required: nil,
     **_extra
   )
     track_event(
@@ -1429,6 +1450,7 @@ def idv_front_image_clicked(
       isDrop: isDrop,
       source: source,
       use_alternate_sdk: use_alternate_sdk,
+      liveness_checking_required: liveness_checking_required,
     )
   end
   # rubocop:enable Naming/VariableName,Naming/MethodParameterName
@@ -2897,6 +2919,7 @@ def idv_sdk_selfie_image_capture_opened(captureAttempts: nil, **extra)
   # @param [String] mimeType MIME type of image added
   # @param [Integer] size size of image added in bytes
   # @param [String] source
+  # @param [String] liveness_checking_required Whether or not the selfie is required
   # @param [Integer] width width of image added in pixels
   # rubocop:disable Naming/VariableName,Naming/MethodParameterName
   def idv_selfie_image_added(
@@ -2908,6 +2931,7 @@ def idv_selfie_image_added(
     mimeType:,
     size:,
     source:,
+    liveness_checking_required:,
     width:,
     **_extra
   )
@@ -2921,6 +2945,7 @@ def idv_selfie_image_added(
       mimeType: mimeType,
       size: size,
       source: source,
+      liveness_checking_required: liveness_checking_required,
       width: width,
     )
   end
@@ -3094,6 +3119,7 @@ def idv_warning_action_triggered(
   # @param [Integer] remaining_submit_attempts (previously called "remaining_attempts")
   # @param [String] subheading
   # @param [Boolean] use_alternate_sdk
+  # @param [Boolean] liveness_checking_required
   def idv_warning_shown(
     acuant_sdk_upgrade_a_b_testing_enabled:,
     acuant_version:,
@@ -3104,6 +3130,7 @@ def idv_warning_shown(
     remaining_submit_attempts:,
     subheading:,
     use_alternate_sdk:,
+    liveness_checking_required:,
     **_extra
   )
     track_event(
@@ -3117,6 +3144,7 @@ def idv_warning_shown(
       remaining_submit_attempts: remaining_submit_attempts,
       subheading: subheading,
       use_alternate_sdk: use_alternate_sdk,
+      liveness_checking_required: liveness_checking_required,
     )
   end
 
diff --git a/spec/features/idv/analytics_spec.rb b/spec/features/idv/analytics_spec.rb
index 93331e720f8..0e74b9e1af6 100644
--- a/spec/features/idv/analytics_spec.rb
+++ b/spec/features/idv/analytics_spec.rb
@@ -63,10 +63,10 @@
         flow_path: 'standard', step: 'document_capture', redo_document_capture: nil, acuant_sdk_upgrade_ab_test_bucket: :default, lexisnexis_instant_verify_workflow_ab_test_bucket: :default, analytics_id: 'Doc Auth', skip_hybrid_handoff: nil, irs_reproofing: false, selfie_check_required: boolean, liveness_checking_required: boolean
       },
       'Frontend: IdV: front image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'Frontend: IdV: back image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'IdV: doc auth image upload form submitted' => {
         success: true, errors: {}, submit_attempts: 1, remaining_submit_attempts: 3, user_id: user.uuid, flow_path: 'standard', front_image_fingerprint: an_instance_of(String), back_image_fingerprint: an_instance_of(String), selfie_image_fingerprint: nil, liveness_checking_required: boolean
@@ -172,10 +172,10 @@
         flow_path: 'hybrid', step: 'document_capture', acuant_sdk_upgrade_ab_test_bucket: :default, lexisnexis_instant_verify_workflow_ab_test_bucket: :default, analytics_id: 'Doc Auth', irs_reproofing: false, selfie_check_required: boolean, liveness_checking_required: boolean
       },
       'Frontend: IdV: front image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'hybrid', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'hybrid', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'Frontend: IdV: back image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'hybrid', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'hybrid', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'IdV: doc auth image upload form submitted' => {
         success: true, errors: {}, submit_attempts: 1, remaining_submit_attempts: 3, user_id: user.uuid, flow_path: 'hybrid', front_image_fingerprint: an_instance_of(String), back_image_fingerprint: an_instance_of(String), selfie_image_fingerprint: nil, liveness_checking_required: boolean
@@ -278,10 +278,10 @@
         flow_path: 'standard', step: 'document_capture', redo_document_capture: nil, acuant_sdk_upgrade_ab_test_bucket: :default, lexisnexis_instant_verify_workflow_ab_test_bucket: :default, skip_hybrid_handoff: nil, analytics_id: 'Doc Auth', irs_reproofing: false, selfie_check_required: boolean, liveness_checking_required: boolean
       },
       'Frontend: IdV: front image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'Frontend: IdV: back image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'IdV: doc auth image upload form submitted' => {
         success: true, errors: {}, submit_attempts: 1, remaining_submit_attempts: 3, user_id: user.uuid, flow_path: 'standard', front_image_fingerprint: an_instance_of(String), back_image_fingerprint: an_instance_of(String), selfie_image_fingerprint: nil, liveness_checking_required: boolean
@@ -366,10 +366,10 @@
         flow_path: 'standard', step: 'document_capture', redo_document_capture: nil, acuant_sdk_upgrade_ab_test_bucket: :default, lexisnexis_instant_verify_workflow_ab_test_bucket: :default, analytics_id: 'Doc Auth', skip_hybrid_handoff: nil, irs_reproofing: false, selfie_check_required: boolean, liveness_checking_required: boolean
       },
       'Frontend: IdV: front image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'Frontend: IdV: back image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'IdV: doc auth image upload form submitted' => {
         success: true, errors: {}, submit_attempts: 1, remaining_submit_attempts: 3, user_id: user.uuid, flow_path: 'standard', front_image_fingerprint: an_instance_of(String), back_image_fingerprint: an_instance_of(String), selfie_image_fingerprint: nil, liveness_checking_required: boolean
@@ -499,10 +499,10 @@
         flow_path: 'standard', step: 'document_capture', redo_document_capture: nil, skip_hybrid_handoff: nil, acuant_sdk_upgrade_ab_test_bucket: :default, lexisnexis_instant_verify_workflow_ab_test_bucket: :default, analytics_id: 'Doc Auth', irs_reproofing: false, selfie_check_required: boolean, liveness_checking_required: true
       },
       'Frontend: IdV: front image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'Frontend: IdV: back image added' => {
-        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil
+        width: 284, height: 38, mimeType: 'image/png', source: 'upload', size: 3694, captureAttempts: 1, flow_path: 'standard', acuant_sdk_upgrade_a_b_testing_enabled: 'false', use_alternate_sdk: anything, acuant_version: anything, acuantCaptureMode: nil, fingerprint: anything, failedImageResubmission: boolean, documentType: nil, dpi: nil, glare: nil, glareScoreThreshold: nil, isAssessedAsBlurry: nil, isAssessedAsGlare: nil, isAssessedAsUnsupported: nil, moire: nil, sharpness: nil, sharpnessScoreThreshold: nil, assessment: nil, liveness_checking_required: boolean
       },
       'IdV: doc auth image upload form submitted' => {
         success: true, errors: {}, submit_attempts: 1, remaining_submit_attempts: 3, user_id: user.uuid, flow_path: 'standard', front_image_fingerprint: an_instance_of(String), back_image_fingerprint: an_instance_of(String), selfie_image_fingerprint: an_instance_of(String), liveness_checking_required: boolean
@@ -515,7 +515,7 @@
         success: true, errors: {}, flow_path: 'standard', step: 'document_capture', redo_document_capture: nil, skip_hybrid_handoff: nil, acuant_sdk_upgrade_ab_test_bucket: :default, lexisnexis_instant_verify_workflow_ab_test_bucket: :default, analytics_id: 'Doc Auth', irs_reproofing: false, selfie_check_required: boolean, liveness_checking_required: true
       },
       :idv_selfie_image_added => {
-        captureAttempts: 1, failedImageResubmission: nil, fingerprint: 'aIzxkX_iMtoxFOURZr55qkshs53emQKUOr7VfTf6G1Q', flow_path: 'standard', height: 38, mimeType: 'image/png', size: 3694, source: 'upload', width: 284
+        captureAttempts: 1, failedImageResubmission: nil, fingerprint: 'aIzxkX_iMtoxFOURZr55qkshs53emQKUOr7VfTf6G1Q', flow_path: 'standard', height: 38, mimeType: 'image/png', size: 3694, source: 'upload', width: 284, liveness_checking_required: boolean
       },
       'IdV: doc auth ssn visited' => {
         flow_path: 'standard', step: 'ssn', acuant_sdk_upgrade_ab_test_bucket: :default, lexisnexis_instant_verify_workflow_ab_test_bucket: :default, skip_hybrid_handoff: anything, analytics_id: 'Doc Auth', irs_reproofing: false
diff --git a/spec/javascript/packages/document-capture/components/acuant-capture-spec.jsx b/spec/javascript/packages/document-capture/components/acuant-capture-spec.jsx
index 13f57e85afc..da4a369ab84 100644
--- a/spec/javascript/packages/document-capture/components/acuant-capture-spec.jsx
+++ b/spec/javascript/packages/document-capture/components/acuant-capture-spec.jsx
@@ -290,6 +290,7 @@ describe('document-capture/components/acuant-capture', () => {
         field: 'test',
         acuantCaptureMode: 'AUTO',
         error: 'Camera not supported',
+        liveness_checking_required: false,
       });
       expect(document.activeElement).to.equal(button);
     });
@@ -322,6 +323,7 @@ describe('document-capture/components/acuant-capture', () => {
         field: 'test',
         acuantCaptureMode: 'AUTO',
         error: 'Cropping failure',
+        liveness_checking_required: false,
       });
       expect(document.activeElement).to.equal(button);
     });
@@ -356,6 +358,7 @@ describe('document-capture/components/acuant-capture', () => {
         field: 'test',
         acuantCaptureMode: 'AUTO',
         error: 'Camera not supported',
+        liveness_checking_required: false,
       });
       expect(document.activeElement).to.equal(button);
     });
@@ -392,6 +395,7 @@ describe('document-capture/components/acuant-capture', () => {
         field: 'test',
         acuantCaptureMode: 'AUTO',
         error: 'iOS 15 GPU Highwater failure (SEQUENCE_BREAK_CODE)',
+        liveness_checking_required: false,
       });
       await waitFor(() => document.activeElement === button);
 
@@ -435,6 +439,7 @@ describe('document-capture/components/acuant-capture', () => {
         field: 'test',
         acuantCaptureMode: 'AUTO',
         error: 'iOS 15 GPU Highwater failure (SEQUENCE_BREAK_CODE)',
+        liveness_checking_required: false,
       });
       await waitFor(() => document.activeElement === button);
 
@@ -478,6 +483,7 @@ describe('document-capture/components/acuant-capture', () => {
         field: 'test',
         acuantCaptureMode: 'AUTO',
         error: 'User or system denied camera access',
+        liveness_checking_required: false,
       });
       expect(document.activeElement).to.equal(button);
     });
@@ -519,6 +525,7 @@ describe('document-capture/components/acuant-capture', () => {
         field: 'test',
         acuantCaptureMode: 'AUTO',
         error: 'User or system denied camera access',
+        liveness_checking_required: false,
       });
       expect(document.activeElement).to.equal(button);
     });
@@ -810,6 +817,7 @@ describe('document-capture/components/acuant-capture', () => {
         acuantCaptureMode: 'AUTO',
         fingerprint: null,
         failedImageResubmission: false,
+        liveness_checking_required: false,
       });
 
       expect(error).to.be.ok();
@@ -869,6 +877,7 @@ describe('document-capture/components/acuant-capture', () => {
         acuantCaptureMode: sinon.match.string,
         fingerprint: null,
         failedImageResubmission: false,
+        liveness_checking_required: false,
       });
 
       expect(error).to.be.ok();
@@ -981,6 +990,7 @@ describe('document-capture/components/acuant-capture', () => {
         acuantCaptureMode: sinon.match.string,
         fingerprint: null,
         failedImageResubmission: false,
+        liveness_checking_required: false,
       });
     });
 
@@ -1315,6 +1325,7 @@ describe('document-capture/components/acuant-capture', () => {
         size: sinon.match.number,
         captureAttempts: sinon.match.number,
         acuantCaptureMode: null,
+        liveness_checking_required: false,
       }),
     );
   });
@@ -1390,14 +1401,17 @@ describe('document-capture/components/acuant-capture', () => {
     expect(trackEvent).to.have.been.calledWith('IdV: test image clicked', {
       source: 'placeholder',
       isDrop: false,
+      liveness_checking_required: false,
     });
     expect(trackEvent).to.have.been.calledWith('IdV: test image clicked', {
       source: 'button',
       isDrop: false,
+      liveness_checking_required: false,
     });
     expect(trackEvent).to.have.been.calledWith('IdV: test image clicked', {
       source: 'upload',
       isDrop: false,
+      liveness_checking_required: false,
     });
   });
 
@@ -1417,6 +1431,7 @@ describe('document-capture/components/acuant-capture', () => {
     expect(trackEvent).to.have.been.calledWith('IdV: test image clicked', {
       source: 'placeholder',
       isDrop: true,
+      liveness_checking_required: false,
     });
   });
 
diff --git a/spec/javascript/packages/document-capture/components/document-capture-warning-spec.jsx b/spec/javascript/packages/document-capture/components/document-capture-warning-spec.jsx
index 9747de9a100..68090e6cb57 100644
--- a/spec/javascript/packages/document-capture/components/document-capture-warning-spec.jsx
+++ b/spec/javascript/packages/document-capture/components/document-capture-warning-spec.jsx
@@ -93,6 +93,7 @@ describe('DocumentCaptureWarning', () => {
         subheading: 'errors.doc_auth.rate_limited_subheading',
         error_message_displayed: 'general error',
         remaining_submit_attempts: 2,
+        liveness_checking_required: false,
       });
     });
 
@@ -245,6 +246,7 @@ describe('DocumentCaptureWarning', () => {
         subheading: '',
         error_message_displayed: 'general error idv.warning.attempts_html',
         remaining_submit_attempts: 2,
+        liveness_checking_required: false,
       });
     });
 
diff --git a/spec/javascript/packages/document-capture/components/review-issues-step-spec.jsx b/spec/javascript/packages/document-capture/components/review-issues-step-spec.jsx
index 7176d76dd81..2afceb62d52 100644
--- a/spec/javascript/packages/document-capture/components/review-issues-step-spec.jsx
+++ b/spec/javascript/packages/document-capture/components/review-issues-step-spec.jsx
@@ -52,6 +52,7 @@ describe('document-capture/components/review-issues-step', () => {
       heading: 'We couldn’t verify your ID',
       subheading: '',
       error_message_displayed: 'test error',
+      liveness_checking_required: false,
     });
 
     const button = getByRole('button');
diff --git a/spec/javascript/packages/document-capture/context/acuant-spec.jsx b/spec/javascript/packages/document-capture/context/acuant-spec.jsx
index 7cbe9af7e08..f1085be79e3 100644
--- a/spec/javascript/packages/document-capture/context/acuant-spec.jsx
+++ b/spec/javascript/packages/document-capture/context/acuant-spec.jsx
@@ -157,6 +157,7 @@ describe('document-capture/context/acuant', () => {
           expect(trackEvent).to.have.been.calledWith('IdV: Acuant SDK loaded', {
             success: true,
             isCameraSupported: true,
+            liveness_checking_required: false,
           });
         });
       });
@@ -177,6 +178,7 @@ describe('document-capture/context/acuant', () => {
           expect(trackEvent).to.have.been.calledWith('IdV: Acuant SDK loaded', {
             success: true,
             isCameraSupported: false,
+            liveness_checking_required: false,
           });
         });
       });
@@ -215,6 +217,7 @@ describe('document-capture/context/acuant', () => {
           success: false,
           code: sinon.match.number,
           description: sinon.match.string,
+          liveness_checking_required: false,
         });
       });
     });

From 7b7e5295de2bc9bb3b5795262016c35ddcd7de20 Mon Sep 17 00:00:00 2001
From: Andrew Duthie <1779930+aduth@users.noreply.github.com>
Date: Fri, 8 Mar 2024 14:48:11 -0500
Subject: [PATCH 06/13] Switch to have_current_path for MFA path comparison
 (#10221)

changelog: Internal, Automated Testing, Improve reliability of automated tests
---
 .../multiple_mfa_sign_up_spec.rb              | 40 +++++++++----------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/spec/features/two_factor_authentication/multiple_mfa_sign_up_spec.rb b/spec/features/two_factor_authentication/multiple_mfa_sign_up_spec.rb
index 7d1ef719e98..3cacae0ba02 100644
--- a/spec/features/two_factor_authentication/multiple_mfa_sign_up_spec.rb
+++ b/spec/features/two_factor_authentication/multiple_mfa_sign_up_spec.rb
@@ -13,7 +13,7 @@
     scenario 'user can set up 2 MFA methods properly' do
       sign_in_before_2fa
 
-      expect(current_path).to eq authentication_methods_setup_path
+      expect(page).to have_current_path authentication_methods_setup_path
 
       click_2fa_option('phone')
       click_2fa_option('backup_code')
@@ -23,7 +23,7 @@
       expect(page).
         to have_content t('headings.add_info.phone')
 
-      expect(current_path).to eq phone_setup_path
+      expect(page).to have_current_path phone_setup_path
 
       fill_in 'new_phone_form_phone', with: '703-555-1212'
       click_send_one_time_code
@@ -31,7 +31,7 @@
       fill_in_code_with_last_phone_otp
       click_submit_default
 
-      expect(current_path).to eq backup_code_setup_path
+      expect(page).to have_current_path backup_code_setup_path
 
       click_continue
 
@@ -41,13 +41,13 @@
 
       expect(page).to have_content(t('notices.backup_codes_configured'))
       expect(fake_analytics).to have_logged_event('User registration: complete')
-      expect(current_path).to eq account_path
+      expect(page).to have_current_path account_path
     end
 
     scenario 'user can select 2 MFA methods and then chooses another method during' do
       sign_in_before_2fa
 
-      expect(current_path).to eq authentication_methods_setup_path
+      expect(page).to have_current_path authentication_methods_setup_path
 
       click_2fa_option('phone')
       click_2fa_option('backup_code')
@@ -57,7 +57,7 @@
       expect(page).
         to have_content t('headings.add_info.phone')
 
-      expect(current_path).to eq phone_setup_path
+      expect(page).to have_current_path phone_setup_path
 
       fill_in 'new_phone_form_phone', with: '703-555-1212'
       click_send_one_time_code
@@ -65,7 +65,7 @@
       fill_in_code_with_last_phone_otp
       click_submit_default
 
-      expect(current_path).to eq backup_code_setup_path
+      expect(page).to have_current_path backup_code_setup_path
 
       click_link t('two_factor_authentication.choose_another_option')
 
@@ -83,21 +83,21 @@
       click_submit_default
 
       expect(fake_analytics).to have_logged_event('User registration: complete')
-      expect(current_path).to eq account_path
+      expect(page).to have_current_path account_path
     end
 
     scenario 'user can select 2 MFA methods and complete after reauthn window' do
       allow(IdentityConfig.store).to receive(:reauthn_window).and_return(10)
       sign_in_before_2fa
 
-      expect(current_path).to eq authentication_methods_setup_path
+      expect(page).to have_current_path authentication_methods_setup_path
 
       click_2fa_option('backup_code')
       click_2fa_option('auth_app')
 
       click_continue
 
-      expect(current_path).to eq authenticator_setup_path
+      expect(page).to have_current_path authenticator_setup_path
 
       fill_in_totp_name
 
@@ -108,10 +108,10 @@
       check t('forms.messages.remember_device')
       click_submit_default
 
-      expect(current_path).to eq backup_code_setup_path
+      expect(page).to have_current_path backup_code_setup_path
       travel_to((IdentityConfig.store.reauthn_window + 5).seconds.from_now) do
         click_continue
-        expect(current_path).to eq login_two_factor_options_path
+        expect(page).to have_current_path login_two_factor_options_path
 
         find("label[for='two_factor_options_form_selection_auth_app']").click
         click_on t('forms.buttons.continue')
@@ -128,14 +128,14 @@
 
         expect(page).to have_content(t('notices.backup_codes_configured'))
 
-        expect(current_path).to eq account_path
+        expect(page).to have_current_path account_path
       end
     end
 
     scenario 'user can select 1 MFA methods and will be prompted to add another method' do
       sign_in_before_2fa
 
-      expect(current_path).to eq authentication_methods_setup_path
+      expect(page).to have_current_path authentication_methods_setup_path
 
       click_2fa_option('phone')
 
@@ -158,7 +158,7 @@
 
       click_button t('mfa.skip')
 
-      expect(current_path).to eq account_path
+      expect(page).to have_current_path account_path
     end
 
     describe 'skipping second mfa' do
@@ -168,7 +168,7 @@
           click_2fa_option('backup_code')
 
           click_continue
-          expect(current_path).to eq backup_code_setup_path
+          expect(page).to have_current_path backup_code_setup_path
 
           click_continue
           expect(page).to have_link(t('components.download_button.label'))
@@ -189,7 +189,7 @@
           click_2fa_option('backup_code')
 
           click_continue
-          expect(current_path).to eq backup_code_setup_path
+          expect(page).to have_current_path backup_code_setup_path
 
           click_continue
           expect(page).to have_link(t('components.download_button.label'))
@@ -214,7 +214,7 @@
           mock_webauthn_setup_challenge
           user = sign_up_and_set_password
           user.password = Features::SessionHelper::VALID_PASSWORD
-          expect(current_path).to eq authentication_methods_setup_path
+          expect(page).to have_current_path authentication_methods_setup_path
           # webauthn option is hidden in browsers that don't support it
           select_2fa_option('webauthn_platform', visible: :all)
 
@@ -242,13 +242,13 @@
     before do
       sign_in_before_2fa
 
-      expect(current_path).to eq authentication_methods_setup_path
+      expect(page).to have_current_path authentication_methods_setup_path
 
       click_2fa_option('backup_code')
 
       click_continue
 
-      expect(current_path).to eq backup_code_setup_path
+      expect(page).to have_current_path backup_code_setup_path
 
       click_continue
 

From 9905a91b0e7bf9cb690fe4649d6a551695fac0e4 Mon Sep 17 00:00:00 2001
From: Andrew Duthie <1779930+aduth@users.noreply.github.com>
Date: Fri, 8 Mar 2024 14:48:32 -0500
Subject: [PATCH 07/13] Remove legacy TOTP deletion routes (#10219)

* Remove legacy TOTP deletion routes

changelog: Internal, Code Quality, Remove legacy MFA management route code

* Remove unused find_form
---
 .../users/totp_setup_controller.rb            | 23 ---------
 app/services/analytics_events.rb              |  6 +--
 app/services/db/auth_app_configuration.rb     |  4 --
 .../users/totp_setup/confirm_delete.html.erb  | 14 ------
 config/locales/account/en.yml                 |  1 -
 config/locales/account/es.yml                 |  1 -
 config/locales/account/fr.yml                 |  1 -
 config/locales/forms/en.yml                   |  4 --
 config/locales/forms/es.yml                   |  4 --
 config/locales/forms/fr.yml                   |  4 --
 config/locales/notices/en.yml                 |  1 -
 config/locales/notices/es.yml                 |  1 -
 config/locales/notices/fr.yml                 |  1 -
 config/routes.rb                              |  2 -
 .../users/totp_setup_controller_spec.rb       | 48 -------------------
 spec/features/users/totp_management_spec.rb   | 23 ++++-----
 16 files changed, 13 insertions(+), 125 deletions(-)
 delete mode 100644 app/views/users/totp_setup/confirm_delete.html.erb

diff --git a/app/controllers/users/totp_setup_controller.rb b/app/controllers/users/totp_setup_controller.rb
index 6e74f1c2425..552326465d5 100644
--- a/app/controllers/users/totp_setup_controller.rb
+++ b/app/controllers/users/totp_setup_controller.rb
@@ -39,14 +39,6 @@ def confirm
       end
     end
 
-    def disable
-      if MfaPolicy.new(current_user).multiple_factors_enabled?
-        process_successful_disable
-      else
-        redirect_to account_two_factor_authentication_path
-      end
-    end
-
     private
 
     def totp_setup_form
@@ -102,21 +94,6 @@ def create_events
       Funnel::Registration::AddMfa.call(current_user.id, 'auth_app', analytics)
     end
 
-    def process_successful_disable
-      analytics.totp_user_disabled
-      create_user_event(:authenticator_disabled)
-      revoke_remember_device(current_user)
-      revoke_otp_secret_key
-      flash[:success] = t('notices.totp_disabled')
-      redirect_to account_two_factor_authentication_path
-    end
-
-    def revoke_otp_secret_key
-      Db::AuthAppConfiguration.delete(current_user, params[:id].to_i)
-      event = PushNotification::RecoveryInformationChangedEvent.new(user: current_user)
-      PushNotification::HttpPush.deliver(event)
-    end
-
     def process_invalid_code
       flash[:error] = if totp_setup_form.name_taken
                         t('errors.piv_cac_setup.unique_name')
diff --git a/app/services/analytics_events.rb b/app/services/analytics_events.rb
index 697feb9fe0d..aa63972278e 100644
--- a/app/services/analytics_events.rb
+++ b/app/services/analytics_events.rb
@@ -188,6 +188,7 @@ def add_phone_setup_visit
     )
   end
 
+  # @identity.idp.previous_event_name TOTP: User Disabled
   # Tracks when a user deletes their auth app from account
   # @param [Boolean] success
   # @param [Hash] error_details
@@ -4609,11 +4610,6 @@ def totp_setup_visit(
     )
   end
 
-  # Tracks when a user disabled a TOTP device
-  def totp_user_disabled
-    track_event('TOTP: User Disabled')
-  end
-
   # @param [String] controller
   # @param [String] referer
   # @param [Boolean] user_signed_in
diff --git a/app/services/db/auth_app_configuration.rb b/app/services/db/auth_app_configuration.rb
index 5b43f2e2ea8..10a893ab95a 100644
--- a/app/services/db/auth_app_configuration.rb
+++ b/app/services/db/auth_app_configuration.rb
@@ -39,10 +39,6 @@ def self.confirm(secret, code)
       )
     end
 
-    def self.delete(current_user, auth_app_cfg_id)
-      ::AuthAppConfiguration.where(user_id: current_user.id, id: auth_app_cfg_id).delete_all
-    end
-
     def self.update_timestamp(cfg, new_timestamp)
       return unless new_timestamp
       cfg.totp_timestamp = new_timestamp
diff --git a/app/views/users/totp_setup/confirm_delete.html.erb b/app/views/users/totp_setup/confirm_delete.html.erb
deleted file mode 100644
index 978b0c75073..00000000000
--- a/app/views/users/totp_setup/confirm_delete.html.erb
+++ /dev/null
@@ -1,14 +0,0 @@
-<% self.title = t('forms.totp_delete.confirm') %>
-
-<%= render AlertIconComponent.new(icon_name: :warning, class: 'display-block margin-bottom-4') %>
-
-<%= render PageHeadingComponent.new.with_content(t('forms.totp_delete.confirm')) %>
-
-<p>
-  <%= t('forms.totp_delete.caution', app_name: APP_NAME) %>
-</p>
-
-<%= form_tag(disable_totp_path(id: params[:id]), method: :delete, class: 'margin-top-5') do %>
-  <%= button_tag t('account.index.totp_confirm_delete'), type: 'submit', class: 'usa-button usa-button--big usa-button--wide margin-bottom-2' %>
-<% end %>
-<%= link_to t('links.cancel'), account_path, class: 'usa-button usa-button--big usa-button--wide usa-button--outline' %>
diff --git a/config/locales/account/en.yml b/config/locales/account/en.yml
index 95819a1fc2e..024b06e89fd 100644
--- a/config/locales/account/en.yml
+++ b/config/locales/account/en.yml
@@ -46,7 +46,6 @@ en:
         instructions: Your profile was recently deactivated due to a password reset.
         link: Reactivate your profile now.
       sign_in_location_and_ip: From %{ip} (IP address potentially located in %{location})
-      totp_confirm_delete: Yes, remove authentication app
       unknown_location: unknown location
       verification:
         instructions: Your account requires a verification code to be verified.
diff --git a/config/locales/account/es.yml b/config/locales/account/es.yml
index a2ffe35568e..2ffae81956a 100644
--- a/config/locales/account/es.yml
+++ b/config/locales/account/es.yml
@@ -47,7 +47,6 @@ es:
         instructions: Su perfil ha sido desactivado debido a un cambio de contraseña.
         link: Reactive su perfil ahora.
       sign_in_location_and_ip: Desde %{ip} (la dirección IP probablemente se encuentra en %{location})
-      totp_confirm_delete: Sí, eliminar la aplicación de autenticación
       unknown_location: ubicación desconocida
       verification:
         instructions: Su cuenta requiere un código de verificación para ser verificado.
diff --git a/config/locales/account/fr.yml b/config/locales/account/fr.yml
index 07f8887835a..abdb9b70614 100644
--- a/config/locales/account/fr.yml
+++ b/config/locales/account/fr.yml
@@ -50,7 +50,6 @@ fr:
           personnelle pour réactiver votre profil.
         link: Réactivez votre profil maintenant.
       sign_in_location_and_ip: '%{ip} (adresse IP probablement située dans %{location})'
-      totp_confirm_delete: Oui, supprimez l’application d’authentification
       unknown_location: lieu inconnu
       verification:
         instructions: Votre compte nécessite un code de vérification pour être vérifié.
diff --git a/config/locales/forms/en.yml b/config/locales/forms/en.yml
index 618ccbec39b..3913bbf946a 100644
--- a/config/locales/forms/en.yml
+++ b/config/locales/forms/en.yml
@@ -108,10 +108,6 @@ en:
         below to continue.
     ssn:
       show: Show Social Security number
-    totp_delete:
-      caution: If you remove your authentication app you won’t be able to use it to
-        access your %{app_name} account.
-      confirm: Are you sure you want to remove your authentication app?
     totp_setup:
       totp_intro: Set up an authentication app to sign in using temporary security codes.
       totp_step_1: Give it a nickname
diff --git a/config/locales/forms/es.yml b/config/locales/forms/es.yml
index 123d5438dd8..a834d40afca 100644
--- a/config/locales/forms/es.yml
+++ b/config/locales/forms/es.yml
@@ -114,10 +114,6 @@ es:
         automatizado. Marque la casilla de abajo para continuar.
     ssn:
       show: Mostrar Número de Seguro Social
-    totp_delete:
-      caution: Si elimina su aplicación de autenticación, no podrá usarla para acceder
-        a su cuenta %{app_name}.
-      confirm: '¿Seguro que quieres eliminar tu aplicación de autenticación?'
     totp_setup:
       totp_intro: Configure una aplicación de autenticación para iniciar sesión con
         códigos de seguridad temporales.
diff --git a/config/locales/forms/fr.yml b/config/locales/forms/fr.yml
index 23d0a94cc58..f0043d507d9 100644
--- a/config/locales/forms/fr.yml
+++ b/config/locales/forms/fr.yml
@@ -116,10 +116,6 @@ fr:
         automatisés. Cochez la case ci-dessous pour continuer.
     ssn:
       show: Afficher le numéro de sécurité sociale
-    totp_delete:
-      caution: Si vous supprimez votre application d’authentification, vous ne pourrez
-        plus l’utiliser pour accéder à votre compte %{app_name}.
-      confirm: Voulez-vous vraiment supprimer votre application d’authentification?
     totp_setup:
       totp_intro: Configurez une application d’authentification pour vous connecter à
         l’aide de codes de sécurité temporaires.
diff --git a/config/locales/notices/en.yml b/config/locales/notices/en.yml
index a617bb02aa9..47d03fd6ba8 100644
--- a/config/locales/notices/en.yml
+++ b/config/locales/notices/en.yml
@@ -54,7 +54,6 @@ en:
           %{time_left_in_session_html} unless you tell us otherwise.
         sign_out: Sign me out
     totp_configured: An authentication app was added to your account.
-    totp_disabled: Your authentication app was deleted from your account.
     use_diff_email:
       link: use a different email address
       text_html: Or, %{link_html}
diff --git a/config/locales/notices/es.yml b/config/locales/notices/es.yml
index 3fae3ca377b..900ab66d96a 100644
--- a/config/locales/notices/es.yml
+++ b/config/locales/notices/es.yml
@@ -56,7 +56,6 @@ es:
           %{time_left_in_session_html} a menos que nos indique lo contrario.
         sign_out: Desconécteme
     totp_configured: Una aplicación de autenticación fue agregada a tu cuenta.
-    totp_disabled: Tu aplicación de autenticación fue eliminada de tu cuenta.
     use_diff_email:
       link: use un email diferente
       text_html: O %{link_html}
diff --git a/config/locales/notices/fr.yml b/config/locales/notices/fr.yml
index 9ed9eb1a3cc..02fb01e12cf 100644
--- a/config/locales/notices/fr.yml
+++ b/config/locales/notices/fr.yml
@@ -59,7 +59,6 @@ fr:
           part.
         sign_out: Déconnectez-moi
     totp_configured: Une application d’authentification a été ajoutée à votre compte.
-    totp_disabled: Votre application d’authentification a été supprimée de votre compte.
     use_diff_email:
       link: utilisez une adresse courriel différente
       text_html: Ou %{link_html}
diff --git a/config/routes.rb b/config/routes.rb
index f0796536901..b6258c589d1 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -235,7 +235,6 @@
     get '/webauthn_setup' => 'users/webauthn_setup#new', as: :webauthn_setup
     patch '/webauthn_setup' => 'users/webauthn_setup#confirm'
 
-    delete '/authenticator_setup' => 'users/totp_setup#disable', as: :disable_totp
     get '/authenticator_setup' => 'users/totp_setup#new'
     patch '/authenticator_setup' => 'users/totp_setup#confirm'
 
@@ -290,7 +289,6 @@
     get '/confirm_backup_codes' => 'users/backup_code_setup#confirm_backup_codes'
 
     get '/piv_cac_delete' => 'users/piv_cac_setup#confirm_delete'
-    get '/auth_app_delete' => 'users/totp_setup#confirm_delete'
     get '/user_please_call' => 'users/please_call#show'
 
     post '/sign_up/create_password' => 'sign_up/passwords#create', as: :sign_up_create_password
diff --git a/spec/controllers/users/totp_setup_controller_spec.rb b/spec/controllers/users/totp_setup_controller_spec.rb
index e0ef5196936..3b5b1304600 100644
--- a/spec/controllers/users/totp_setup_controller_spec.rb
+++ b/spec/controllers/users/totp_setup_controller_spec.rb
@@ -382,54 +382,6 @@
     end
   end
 
-  describe '#disable' do
-    context 'when a user has configured TOTP' do
-      it 'disables TOTP' do
-        user = create(:user, :fully_registered, :with_phone)
-        totp_app = user.auth_app_configurations.create(otp_secret_key: 'foo', name: 'My Auth App')
-        user.save
-        stub_sign_in(user)
-
-        stub_analytics
-        allow(@analytics).to receive(:track_event)
-        expect(PushNotification::HttpPush).to receive(:deliver).
-          with(PushNotification::RecoveryInformationChangedEvent.new(user: user))
-        allow(subject).to receive(:create_user_event)
-
-        delete :disable, params: { id: totp_app.id }
-
-        expect(user.reload.auth_app_configurations.any?).to eq false
-        expect(response).to redirect_to(account_two_factor_authentication_path)
-        expect(flash[:success]).to eq t('notices.totp_disabled')
-        expect(@analytics).to have_received(:track_event).with('TOTP: User Disabled')
-        expect(subject).to have_received(:create_user_event).with(:authenticator_disabled)
-      end
-
-      it 'revokes remember device cookies' do
-        user = create(:user, :fully_registered, :with_phone)
-        totp_app = user.auth_app_configurations.create(otp_secret_key: 'foo', name: 'My Auth App')
-        user.save
-        stub_sign_in(user)
-        expect(user.remember_device_revoked_at).to eq nil
-        freeze_time do
-          delete :disable, params: { id: totp_app.id }
-          expect(user.reload.remember_device_revoked_at).to eq Time.zone.now
-        end
-      end
-    end
-
-    context 'when totp is the last mfa method' do
-      it 'does not disable totp' do
-        user = create(:user, :with_authentication_app)
-        stub_sign_in user
-
-        delete :disable
-        expect(response).to redirect_to(account_two_factor_authentication_path)
-        expect(user.reload.auth_app_configurations.any?).to eq true
-      end
-    end
-  end
-
   def next_auth_app_id
     recs = ActiveRecord::Base.connection.execute(
       "SELECT NEXTVAL(pg_get_serial_sequence('auth_app_configurations', 'id')) AS new_id",
diff --git a/spec/features/users/totp_management_spec.rb b/spec/features/users/totp_management_spec.rb
index ca400b234a9..3e68beef5be 100644
--- a/spec/features/users/totp_management_spec.rb
+++ b/spec/features/users/totp_management_spec.rb
@@ -97,17 +97,24 @@
   end
 
   context 'when totp is the only mfa method' do
-    let(:user) { create(:user, :with_authentication_app, :with_phone) }
+    let(:user) { create(:user, :with_authentication_app) }
 
-    it 'does not show the user the option to disable their totp app' do
+    it 'prevents a user from deleting their last authenticator', :js, allow_browser_log: true do
       sign_in_and_2fa_user(user)
       visit account_two_factor_authentication_path
 
+      click_button(
+        format(
+          '%s: %s',
+          t('two_factor_authentication.auth_app.manage_accessible_label'),
+          user.auth_app_configurations.first.name,
+        ),
+      )
+      accept_confirm(wait: 5) { click_button t('components.manageable_authenticator.delete') }
       expect(page).to have_content(
-        t('two_factor_authentication.login_options.auth_app'),
+        t('errors.manage_authenticator.remove_only_method_error'),
+        wait: 5,
       )
-      form = find_form(page, action: disable_totp_url)
-      expect(form).to be_nil
     end
   end
 
@@ -185,10 +192,4 @@
       end
     end
   end
-
-  def find_form(page, attributes)
-    page.all('form').detect do |form|
-      attributes.all? { |key, value| form[key] == value }
-    end
-  end
 end

From 7938717ff1a39791cdb179e95cbbe0fcccbfd8f7 Mon Sep 17 00:00:00 2001
From: Andrew Duthie <1779930+aduth@users.noreply.github.com>
Date: Fri, 8 Mar 2024 15:24:41 -0500
Subject: [PATCH 08/13] Remove legacy PIV/CAC deletion routes (#10218)

* Remove legacy PIV/CAC deletion routes

changelog: Internal, Code Quality, Remove legacy MFA management route code

* Remove unused find_form
---
 ...piv_cac_authentication_setup_controller.rb | 26 -------
 .../users/piv_cac_setup_controller.rb         | 12 ---
 app/services/analytics_events.rb              | 10 +--
 .../piv_cac_setup/confirm_delete.html.erb     | 14 ----
 config/locales/account/en.yml                 |  1 -
 config/locales/account/es.yml                 |  1 -
 config/locales/account/fr.yml                 |  1 -
 config/locales/forms/en.yml                   |  4 -
 config/locales/forms/es.yml                   |  4 -
 config/locales/forms/fr.yml                   |  4 -
 config/locales/notices/en.yml                 |  1 -
 config/locales/notices/es.yml                 |  1 -
 config/locales/notices/fr.yml                 |  1 -
 config/routes.rb                              |  2 -
 ...ac_authentication_setup_controller_spec.rb | 77 -------------------
 .../features/users/piv_cac_management_spec.rb | 31 ++++----
 16 files changed, 16 insertions(+), 174 deletions(-)
 delete mode 100644 app/controllers/users/piv_cac_setup_controller.rb
 delete mode 100644 app/views/users/piv_cac_setup/confirm_delete.html.erb

diff --git a/app/controllers/users/piv_cac_authentication_setup_controller.rb b/app/controllers/users/piv_cac_authentication_setup_controller.rb
index b0c62e0bba5..d6c30f2106d 100644
--- a/app/controllers/users/piv_cac_authentication_setup_controller.rb
+++ b/app/controllers/users/piv_cac_authentication_setup_controller.rb
@@ -9,7 +9,6 @@ class PivCacAuthenticationSetupController < ApplicationController
 
     before_action :authenticate_user!
     before_action :confirm_user_authenticated_for_2fa_setup
-    before_action :authorize_piv_cac_disable, only: :delete
     before_action :set_piv_cac_setup_csp_form_action_uris, only: :new
     before_action :cap_piv_cac_count, only: %i[new submit_new_piv_cac]
     before_action :confirm_recently_authenticated_2fa
@@ -33,15 +32,6 @@ def error
       )
     end
 
-    def delete
-      analytics.piv_cac_disabled
-      remove_piv_cac
-      clear_piv_cac_information
-      create_user_event(:piv_cac_disabled)
-      flash[:success] = t('notices.piv_cac_disabled')
-      redirect_to account_two_factor_authentication_path
-    end
-
     def submit_new_piv_cac
       if good_nickname
         user_session[:piv_cac_nickname] = params[:name]
@@ -59,13 +49,6 @@ def track_piv_cac_setup_visit
       analytics.piv_cac_setup_visited(**analytics_properties)
     end
 
-    def remove_piv_cac
-      revoke_remember_device(current_user)
-      current_user.piv_cac_configurations.where(id: params[:id].to_i).delete_all
-      event = PushNotification::RecoveryInformationChangedEvent.new(user: current_user)
-      PushNotification::HttpPush.deliver(event)
-    end
-
     def render_prompt
       @presenter = PivCacAuthenticationSetupPresenter.new(
         current_user, user_fully_authenticated?, user_piv_cac_form
@@ -126,10 +109,6 @@ def track_mfa_method_added
       Funnel::Registration::AddMfa.call(current_user.id, 'piv_cac', analytics)
     end
 
-    def piv_cac_enabled?
-      TwoFactorAuthentication::PivCacPolicy.new(current_user).enabled?
-    end
-
     def process_invalid_submission
       if user_piv_cac_form.name_taken
         flash.now[:error] = t('errors.piv_cac_setup.unique_name')
@@ -140,11 +119,6 @@ def process_invalid_submission
       end
     end
 
-    def authorize_piv_cac_disable
-      return if piv_cac_enabled? && MfaPolicy.new(current_user).multiple_factors_enabled?
-      redirect_to account_two_factor_authentication_path
-    end
-
     def good_nickname
       name = params[:name]
       name.present? && !PivCacConfiguration.exists?(user_id: current_user.id, name: name)
diff --git a/app/controllers/users/piv_cac_setup_controller.rb b/app/controllers/users/piv_cac_setup_controller.rb
deleted file mode 100644
index aa3f9d9edfa..00000000000
--- a/app/controllers/users/piv_cac_setup_controller.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-module Users
-  class PivCacSetupController < ApplicationController
-    include ReauthenticationRequiredConcern
-
-    before_action :confirm_two_factor_authenticated
-    before_action :confirm_recently_authenticated_2fa
-
-    def delete; end
-
-    def confirm_delete; end
-  end
-end
diff --git a/app/services/analytics_events.rb b/app/services/analytics_events.rb
index aa63972278e..df5c5d39819 100644
--- a/app/services/analytics_events.rb
+++ b/app/services/analytics_events.rb
@@ -3978,6 +3978,9 @@ def phone_input_country_changed(country_code:, **extra)
     track_event(:phone_input_country_changed, country_code:, **extra)
   end
 
+  # @identity.idp.previous_event_name User Registration: piv cac disabled
+  # @identity.idp.previous_event_name PIV CAC disabled
+  # @identity.idp.previous_event_name piv_cac_disabled
   # @param [Boolean] success
   # @param [Hash] error_details
   # @param [Integer] configuration_id
@@ -3997,13 +4000,6 @@ def piv_cac_delete_submitted(
     )
   end
 
-  # @identity.idp.previous_event_name User Registration: piv cac disabled
-  # @identity.idp.previous_event_name PIV CAC disabled
-  # Tracks when user's piv cac is disabled
-  def piv_cac_disabled
-    track_event(:piv_cac_disabled)
-  end
-
   # @identity.idp.previous_event_name PIV/CAC login
   # @param [Boolean] success
   # @param [Hash] errors
diff --git a/app/views/users/piv_cac_setup/confirm_delete.html.erb b/app/views/users/piv_cac_setup/confirm_delete.html.erb
deleted file mode 100644
index acca327023b..00000000000
--- a/app/views/users/piv_cac_setup/confirm_delete.html.erb
+++ /dev/null
@@ -1,14 +0,0 @@
-<% self.title = t('forms.piv_cac_delete.confirm') %>
-
-<%= render AlertIconComponent.new(icon_name: :warning, class: 'display-block margin-bottom-4') %>
-
-<%= render PageHeadingComponent.new.with_content(t('forms.piv_cac_delete.confirm')) %>
-
-<p>
-  <%= t('forms.piv_cac_delete.caution', app_name: APP_NAME) %>
-</p>
-
-<%= form_tag(disable_piv_cac_url(id: params[:id]), method: :delete, class: 'margin-top-5') do %>
-  <%= button_tag t('account.index.piv_cac_confirm_delete'), type: 'submit', class: 'usa-button usa-button--big usa-button--wide margin-bottom-2' %>
-<% end %>
-<%= link_to t('links.cancel'), account_path, class: 'usa-button usa-button--big usa-button--wide usa-button--outline' %>
diff --git a/config/locales/account/en.yml b/config/locales/account/en.yml
index 024b06e89fd..f1d9ab047e8 100644
--- a/config/locales/account/en.yml
+++ b/config/locales/account/en.yml
@@ -41,7 +41,6 @@ en:
       phone: Phone numbers
       phone_add: Add phone
       piv_cac_add: Add ID
-      piv_cac_confirm_delete: Yes, remove card
       reactivation:
         instructions: Your profile was recently deactivated due to a password reset.
         link: Reactivate your profile now.
diff --git a/config/locales/account/es.yml b/config/locales/account/es.yml
index 2ffae81956a..9d09643015e 100644
--- a/config/locales/account/es.yml
+++ b/config/locales/account/es.yml
@@ -42,7 +42,6 @@ es:
       phone: Teléfono
       phone_add: Añadir teléfono
       piv_cac_add: Agregar ID
-      piv_cac_confirm_delete: Sí, retire la tarjeta
       reactivation:
         instructions: Su perfil ha sido desactivado debido a un cambio de contraseña.
         link: Reactive su perfil ahora.
diff --git a/config/locales/account/fr.yml b/config/locales/account/fr.yml
index abdb9b70614..f079e06f88e 100644
--- a/config/locales/account/fr.yml
+++ b/config/locales/account/fr.yml
@@ -43,7 +43,6 @@ fr:
       phone: Numéro de téléphone
       phone_add: Ajouter un téléphone
       piv_cac_add: Ajouter un identifiant
-      piv_cac_confirm_delete: Oui, retirer la carte
       reactivation:
         instructions: Votre profil a été récemment désactivé en raison d’une
           réinitialisation de mot passe. Vous pouvez utiliser votre clé
diff --git a/config/locales/forms/en.yml b/config/locales/forms/en.yml
index 3913bbf946a..0136ba1452b 100644
--- a/config/locales/forms/en.yml
+++ b/config/locales/forms/en.yml
@@ -83,10 +83,6 @@ en:
     phone:
       buttons:
         delete: Remove phone
-    piv_cac_delete:
-      caution: If you remove your PIV/CAC card you won’t be able to use it to access
-        your %{app_name} account.
-      confirm: Are you sure you want to remove your PIV/CAC card?
     piv_cac_login:
       submit: Insert your PIV/CAC
     piv_cac_mfa:
diff --git a/config/locales/forms/es.yml b/config/locales/forms/es.yml
index a834d40afca..ccf56b21093 100644
--- a/config/locales/forms/es.yml
+++ b/config/locales/forms/es.yml
@@ -88,10 +88,6 @@ es:
     phone:
       buttons:
         delete: Eliminar el teléfono
-    piv_cac_delete:
-      caution: Si retira su tarjeta PIV/CAC, no podrá usarla para acceder a su cuenta
-        %{app_name}.
-      confirm: '¿Estás seguro de que deseas eliminar tu tarjeta PIV/CAC?'
     piv_cac_login:
       submit: Inserte su PIV/CAC
     piv_cac_mfa:
diff --git a/config/locales/forms/fr.yml b/config/locales/forms/fr.yml
index f0043d507d9..af64021bc8c 100644
--- a/config/locales/forms/fr.yml
+++ b/config/locales/forms/fr.yml
@@ -90,10 +90,6 @@ fr:
     phone:
       buttons:
         delete: Supprimer le numéro de teléfono
-    piv_cac_delete:
-      caution: Si vous retirez votre carte PIV/CAC, vous ne pourrez plus l’utiliser
-        pour accéder à votre compte %{app_name}.
-      confirm: Êtes-vous sûr de vouloir retirer votre carte PIV/CAC?
     piv_cac_login:
       submit: Insérez votre PIV/CAC
     piv_cac_mfa:
diff --git a/config/locales/notices/en.yml b/config/locales/notices/en.yml
index 47d03fd6ba8..79cd0f42642 100644
--- a/config/locales/notices/en.yml
+++ b/config/locales/notices/en.yml
@@ -16,7 +16,6 @@ en:
     password_changed: You changed your password.
     phone_confirmed: A phone was added to your account.
     piv_cac_configured: A PIV/CAC card was added to your account.
-    piv_cac_disabled: Your PIV/CAC was deleted from your account.
     privacy:
       privacy_act_statement: Privacy Act Statement
       security_and_privacy_practices: Security Practices and Privacy Act Statement
diff --git a/config/locales/notices/es.yml b/config/locales/notices/es.yml
index 900ab66d96a..43c3208b640 100644
--- a/config/locales/notices/es.yml
+++ b/config/locales/notices/es.yml
@@ -16,7 +16,6 @@ es:
     password_changed: Ha cambiado su contraseña.
     phone_confirmed: Un teléfono fue agregado a tu cuenta.
     piv_cac_configured: Una tarjeta PIV/CAC fue agregada a tu cuenta.
-    piv_cac_disabled: Tu PIV/CAC fue eliminado de tu cuenta.
     privacy:
       privacy_act_statement: Declaración de la ley de privacidad
       security_and_privacy_practices: Prácticas de seguridad y privacidad
diff --git a/config/locales/notices/fr.yml b/config/locales/notices/fr.yml
index 02fb01e12cf..28101deff08 100644
--- a/config/locales/notices/fr.yml
+++ b/config/locales/notices/fr.yml
@@ -16,7 +16,6 @@ fr:
     password_changed: Vous avez changé votre mot de passe.
     phone_confirmed: Un téléphone a été ajouté à votre compte.
     piv_cac_configured: Une carte PIV / CAC a été ajoutée à votre compte.
-    piv_cac_disabled: Votre PIV / CAC a été supprimé de votre compte.
     privacy:
       privacy_act_statement: Déclaration de confidentialité
       security_and_privacy_practices: Pratiques de sécurité et de confidentialité
diff --git a/config/routes.rb b/config/routes.rb
index b6258c589d1..0e11ce3dcc0 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -228,7 +228,6 @@
 
     get '/piv_cac' => 'users/piv_cac_authentication_setup#new', as: :setup_piv_cac
     get '/piv_cac_error' => 'users/piv_cac_authentication_setup#error', as: :setup_piv_cac_error
-    delete '/piv_cac' => 'users/piv_cac_authentication_setup#delete', as: :disable_piv_cac
     post '/present_piv_cac' => 'users/piv_cac_authentication_setup#submit_new_piv_cac',
          as: :submit_new_piv_cac
 
@@ -288,7 +287,6 @@
     delete '/backup_code_delete' => 'users/backup_code_setup#delete'
     get '/confirm_backup_codes' => 'users/backup_code_setup#confirm_backup_codes'
 
-    get '/piv_cac_delete' => 'users/piv_cac_setup#confirm_delete'
     get '/user_please_call' => 'users/please_call#show'
 
     post '/sign_up/create_password' => 'sign_up/passwords#create', as: :sign_up_create_password
diff --git a/spec/controllers/users/piv_cac_authentication_setup_controller_spec.rb b/spec/controllers/users/piv_cac_authentication_setup_controller_spec.rb
index 0de160d48a7..004e74474f2 100644
--- a/spec/controllers/users/piv_cac_authentication_setup_controller_spec.rb
+++ b/spec/controllers/users/piv_cac_authentication_setup_controller_spec.rb
@@ -20,14 +20,6 @@
         expect(response).to redirect_to(root_url)
       end
     end
-
-    describe 'DELETE delete' do
-      it 'redirects to root url' do
-        delete :delete
-
-        expect(response).to redirect_to(root_url)
-      end
-    end
   end
 
   describe 'when signed out' do
@@ -52,13 +44,6 @@
         expect(response).to redirect_to(user_two_factor_authentication_url)
       end
     end
-
-    describe 'DELETE delete' do
-      it 'redirects to root url' do
-        delete :delete
-        expect(response).to redirect_to(user_two_factor_authentication_url)
-      end
-    end
   end
 
   describe 'when signed in' do
@@ -220,68 +205,6 @@
           end
         end
       end
-
-      describe 'DELETE delete' do
-        it 'redirects to account 2FA page' do
-          delete :delete
-          expect(response).to redirect_to(account_two_factor_authentication_path)
-        end
-      end
-    end
-
-    context 'with associated piv/cac' do
-      let(:user) { create(:user, :fully_registered, :with_piv_or_cac) }
-
-      describe 'GET index' do
-        it 'does not redirect to account page because we allow multiple PIV/CACs' do
-          get :new
-          expect(response).to render_template(:new)
-        end
-      end
-
-      describe 'DELETE delete' do
-        let(:piv_cac_configuration_id) { user.piv_cac_configurations.first.id }
-
-        it 'redirects to account page' do
-          delete :delete, params: { id: piv_cac_configuration_id }
-          expect(response).to redirect_to(account_two_factor_authentication_path)
-        end
-
-        it 'removes the piv/cac association' do
-          delete :delete, params: { id: piv_cac_configuration_id }
-          expect(user.reload.piv_cac_configurations).to be_empty
-        end
-
-        it 'sends a recovery information changed event' do
-          expect(PushNotification::HttpPush).to receive(:deliver).
-            with(PushNotification::RecoveryInformationChangedEvent.new(user: user))
-          delete :delete, params: { id: piv_cac_configuration_id }
-        end
-
-        it 'resets the remember device revocation date/time' do
-          expect(user.remember_device_revoked_at).to eq nil
-          freeze_time do
-            delete :delete, params: { id: piv_cac_configuration_id }
-            expect(user.reload.remember_device_revoked_at).to eq Time.zone.now
-          end
-        end
-
-        it 'removes the piv/cac information from the user session' do
-          subject.user_session[:decrypted_x509] = {}
-          delete :delete, params: { id: piv_cac_configuration_id }
-          expect(subject.user_session[:decrypted_x509]).to be_nil
-        end
-
-        it 'does not remove the piv/cac association if it is the last mfa method' do
-          user.phone_configurations.destroy_all
-          user.backup_code_configurations.destroy_all
-
-          delete :delete, params: { id: piv_cac_configuration_id }
-
-          expect(response).to redirect_to(account_two_factor_authentication_path)
-          expect(user.reload.piv_cac_configurations.first.x509_dn_uuid).to_not be_nil
-        end
-      end
     end
   end
 end
diff --git a/spec/features/users/piv_cac_management_spec.rb b/spec/features/users/piv_cac_management_spec.rb
index 7ff12100047..9714cd25880 100644
--- a/spec/features/users/piv_cac_management_spec.rb
+++ b/spec/features/users/piv_cac_management_spec.rb
@@ -1,12 +1,6 @@
 require 'rails_helper'
 
 RSpec.feature 'PIV/CAC Management', allowed_extra_analytics: [:*] do
-  def find_form(page, attributes)
-    page.all('form').detect do |form|
-      attributes.all? { |key, value| form[key] == value }
-    end
-  end
-
   context 'with no piv/cac associated yet' do
     let(:uuid) { SecureRandom.uuid }
     let(:user) { create(:user, :fully_registered, :with_phone, with: { phone: '+1 202-555-1212' }) }
@@ -139,15 +133,6 @@ def find_form(page, attributes)
         ),
       )
     end
-
-    scenario "doesn't allow unassociation of a piv/cac" do
-      stub_piv_cac_service
-
-      sign_in_and_2fa_user(user)
-      visit account_path
-      form = find_form(page, action: disable_piv_cac_url)
-      expect(form).to be_nil
-    end
   end
 
   context 'with a piv/cac associated' do
@@ -200,12 +185,22 @@ def find_form(page, attributes)
   context 'with PIV/CAC as the only MFA method' do
     let(:user) { create(:user, :with_piv_or_cac) }
 
-    scenario 'disallows disassociation PIV/CAC' do
+    scenario 'disallows disassociation PIV/CAC', :js, allow_browser_log: true do
       sign_in_and_2fa_user(user)
       visit account_path
 
-      form = find_form(page, action: disable_piv_cac_url)
-      expect(form).to be_nil
+      click_button(
+        format(
+          '%s: %s',
+          t('two_factor_authentication.piv_cac.manage_accessible_label'),
+          user.piv_cac_configurations.first.name,
+        ),
+      )
+      accept_confirm(wait: 5) { click_button t('components.manageable_authenticator.delete') }
+      expect(page).to have_content(
+        t('errors.manage_authenticator.remove_only_method_error'),
+        wait: 5,
+      )
 
       user.reload
       expect(user.piv_cac_configurations.first.x509_dn_uuid).to_not be_nil

From ad0326984fc47c2ec77677deea011da659c8f744 Mon Sep 17 00:00:00 2001
From: Jonathan Hooper <jonathan.hooper@gsa.gov>
Date: Fri, 8 Mar 2024 17:31:01 -0500
Subject: [PATCH 09/13] Add the `vot` to the SAML response when it is used as
 an AuthnContext for SAML (#10224)

In #10178 we added the ability for SAML service providers to make a request with a vector of trust in the AuthnContext. When a SAML SP does this the vector of trust that is used for the authentication transaction should be reflected to the SP in the SAML response.

The authentication context appears in 2 places in the SAML request:

1. In the authn context for the entire transaction:

    ```xml
    <AuthnStatement AuthnInstant="2024-01-01T00:00:00" SessionIndex="_abc-123-def-456">
      <AuthnContext>
        <AuthnContextClassRef>A1.B2.C3</AuthnContextClassRef>
      </AuthnContext>
    </AuthnStatement>
    ```

2. In the attribute statement. With ACR values these appeared as seperated AAL and IAL nodes. For VTRs they appear in a single VTR node:

    ```xml
    <AttributeStatement>
      <!-- ... -->
      <Attribute Name="vot" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="vot">
        <AttributeValue>A1.B2.C3</AttributeValue>
      </Attribute>
    </AttributeStatement>
    ```

Making the VoT appear like this required changes in 2 places:

1. In the SAML controller the correct `authn_context` value was passed to the `#encode_response` method. This is a method from the `18f/saml_idp` gem which is overriden in `SamlIdpController`.
2. The `AttributeAsserter` was modified to recognized a VTR request and add the correct values to the `AttributeStatement` node in the SAML response.

changelog: Internal, SAML, VTR support was added to SAML Response
---
 .../concerns/saml_idp_auth_concern.rb         |  8 +-
 app/controllers/saml_idp_controller.rb        |  1 +
 app/services/attribute_asserter.rb            | 44 +++++++----
 spec/features/saml/vtr_spec.rb                | 44 ++++++++++-
 spec/services/attribute_asserter_spec.rb      | 79 +++++++++++++++++++
 5 files changed, 158 insertions(+), 18 deletions(-)

diff --git a/app/controllers/concerns/saml_idp_auth_concern.rb b/app/controllers/concerns/saml_idp_auth_concern.rb
index 4ac01f23005..3e4a139b7a1 100644
--- a/app/controllers/concerns/saml_idp_auth_concern.rb
+++ b/app/controllers/concerns/saml_idp_auth_concern.rb
@@ -129,8 +129,10 @@ def default_ial_context
     end
   end
 
-  def requested_aal_authn_context
-    saml_request.requested_aal_authn_context || default_aal_context
+  def response_authn_context
+    saml_request.requested_vtr_authn_context ||
+      saml_request.requested_aal_authn_context ||
+      default_aal_context
   end
 
   def requested_ial_authn_context
@@ -186,7 +188,7 @@ def saml_response
     encode_response(
       current_user,
       name_id_format: name_id_format,
-      authn_context_classref: requested_aal_authn_context,
+      authn_context_classref: response_authn_context,
       reference_id: active_identity.session_uuid,
       encryption: encryption_opts,
       signature: saml_response_signature_options,
diff --git a/app/controllers/saml_idp_controller.rb b/app/controllers/saml_idp_controller.rb
index 98c879a6de1..e2d1ac49c3d 100644
--- a/app/controllers/saml_idp_controller.rb
+++ b/app/controllers/saml_idp_controller.rb
@@ -137,6 +137,7 @@ def log_external_saml_auth_request
     analytics.saml_auth_request(
       requested_ial: requested_ial,
       requested_aal_authn_context: saml_request&.requested_aal_authn_context,
+      requested_vtr_authn_context: saml_request&.requested_vtr_authn_context,
       force_authn: saml_request&.force_authn?,
       final_auth_request: sp_session[:final_auth_request],
       service_provider: saml_request&.issuer,
diff --git a/app/services/attribute_asserter.rb b/app/services/attribute_asserter.rb
index b1238b4d091..f700f9142af 100644
--- a/app/services/attribute_asserter.rb
+++ b/app/services/attribute_asserter.rb
@@ -35,9 +35,14 @@ def build
     add_email(attrs) if bundle.include? :email
     add_all_emails(attrs) if bundle.include? :all_emails
     add_bundle(attrs) if should_add_proofed_attributes?
-    add_verified_at(attrs) if bundle.include?(:verified_at) && ial_context.ial2_service_provider?
-    add_aal(attrs)
-    add_ial(attrs) if authn_request.requested_ial_authn_context || !service_provider.ial.nil?
+    add_verified_at(attrs) if bundle.include?(:verified_at) && ial2_service_provider?
+    if authn_request.requested_vtr_authn_context.present?
+      add_vot(attrs)
+    else
+      add_aal(attrs)
+      add_ial(attrs) if authn_request.requested_ial_authn_context || !service_provider.ial.nil?
+    end
+
     add_x509(attrs) if bundle.include?(:x509_presented) && x509_data
     user.asserted_attributes = attrs
   end
@@ -53,20 +58,22 @@ def build
 
   def should_add_proofed_attributes?
     return false if !user.active_profile.present?
-    ial_context.ial2_or_greater? || ial_max_requested?
+    resolved_authn_context_result.identity_proofing_or_ialmax?
   end
 
-  def ial_max_requested?
-    ial_acr_value = FederatedProtocols::Saml.new(authn_request).ial
-    Vot::LegacyComponentValues.by_name[ial_acr_value]&.requirements&.include?(:ialmax)
+  def ial2_service_provider?
+    service_provider.ial.to_i >= ::Idp::Constants::IAL2
   end
 
-  def ial_context
-    @ial_context ||= IalContext.new(
-      ial: authn_context,
-      service_provider: service_provider,
-      user: user,
-    )
+  def resolved_authn_context_result
+    @resolved_authn_context_result ||= begin
+      saml = FederatedProtocols::Saml.new(authn_request)
+      AuthnContextResolver.new(
+        service_provider: service_provider,
+        vtr: saml.vtr,
+        acr_values: saml.acr_values,
+      ).resolve
+    end
   end
 
   def default_attrs
@@ -125,6 +132,11 @@ def add_verified_at(attrs)
     attrs[:verified_at] = { getter: verified_at_getter_function }
   end
 
+  def add_vot(attrs)
+    context = resolved_authn_context_result.component_values.map(&:name).join('.')
+    attrs[:vot] = { getter: vot_getter_function(context) }
+  end
+
   def add_aal(attrs)
     requested_context = authn_request.requested_aal_authn_context
     requested_aal_level = Saml::Idp::Constants::AUTHN_CONTEXT_CLASSREF_TO_AAL[requested_context]
@@ -145,7 +157,7 @@ def add_ial(attrs)
   end
 
   def ialmax_requested_and_fullfilable?
-    ial_max_requested? && user.active_profile.present?
+    resolved_authn_context_result.ialmax? && user.active_profile.present?
   end
 
   def sp_ial
@@ -169,6 +181,10 @@ def verified_at_getter_function
     ->(principal) { principal.active_profile&.verified_at&.iso8601 }
   end
 
+  def vot_getter_function(vot_authn_context)
+    ->(_principal) { vot_authn_context }
+  end
+
   def aal_getter_function(aal_authn_context)
     ->(_principal) { aal_authn_context }
   end
diff --git a/spec/features/saml/vtr_spec.rb b/spec/features/saml/vtr_spec.rb
index 3d95f889bfc..48a75bf953d 100644
--- a/spec/features/saml/vtr_spec.rb
+++ b/spec/features/saml/vtr_spec.rb
@@ -32,8 +32,12 @@
     expect_successful_saml_redirect
 
     xmldoc = SamlResponseDoc.new('feature', 'response_assertion')
-    email = xmldoc.attribute_node_for('email').children.map(&:text).join
+    expect(xmldoc.assertion_statement_node.content).to eq('C1')
+    expect(xmldoc.attribute_node_for('vot').content).to eq('C1')
+    expect(xmldoc.attribute_node_for('ial')).to be_nil
+    expect(xmldoc.attribute_node_for('aal')).to be_nil
 
+    email = xmldoc.attribute_node_for('email').content
     expect(user.email_addresses.first.email).to eq(email)
   end
 
@@ -149,6 +153,44 @@
     expect_successful_saml_redirect
   end
 
+  scenario 'sign in with VTR request for idv includes proofed attributes' do
+    pii = {
+      first_name: 'Jonathan',
+      ssn: '900-66-6666',
+    }
+    user = create(:user, :fully_registered)
+    create(:profile, :active, user: user, pii: pii)
+
+    visit_saml_authn_request_url(
+      overrides: {
+        issuer: sp1_issuer,
+        authn_context: [
+          'C1.C2.P1',
+          "#{Saml::Idp::Constants::REQUESTED_ATTRIBUTES_CLASSREF}first_name",
+          "#{Saml::Idp::Constants::REQUESTED_ATTRIBUTES_CLASSREF}ssn",
+        ],
+      },
+    )
+    sign_in_live_with_2fa(user)
+    click_submit_default
+    click_agree_and_continue
+    click_submit_default
+
+    expect_successful_saml_redirect
+
+    xmldoc = SamlResponseDoc.new('feature', 'response_assertion')
+    expect(xmldoc.assertion_statement_node.content).to eq('C1.C2.P1')
+    expect(xmldoc.attribute_node_for('vot').content).to eq('C1.C2.P1')
+    expect(xmldoc.attribute_node_for('ial')).to be_nil
+    expect(xmldoc.attribute_node_for('aal')).to be_nil
+
+    first_name = xmldoc.attribute_node_for('first_name').content
+    ssn = xmldoc.attribute_node_for('ssn').content
+
+    expect(first_name).to eq(pii[:first_name])
+    expect(ssn).to eq(pii[:ssn])
+  end
+
   scenario 'sign in with VTR request for idv with biometric requires idv with biometric', :js do
     allow(IdentityConfig.store).to receive(:doc_auth_selfie_capture_enabled).and_return(true)
 
diff --git a/spec/services/attribute_asserter_spec.rb b/spec/services/attribute_asserter_spec.rb
index f991fe6d162..abe490c707c 100644
--- a/spec/services/attribute_asserter_spec.rb
+++ b/spec/services/attribute_asserter_spec.rb
@@ -50,6 +50,15 @@
     )
     CGI.unescape ial1_authn_request_url.split('SAMLRequest').last
   end
+  let(:raw_vtr_no_proofing_authn_request) do
+    vtr_proofing_authn_request = saml_authn_request_url(
+      overrides: {
+        issuer: sp1_issuer,
+        authn_context: 'C1.C2',
+      },
+    )
+    CGI.unescape vtr_proofing_authn_request.split('SAMLRequest').last
+  end
   let(:raw_ial2_authn_request) do
     ial2_authnrequest = saml_authn_request_url(
       overrides: {
@@ -59,6 +68,15 @@
     )
     CGI.unescape ial2_authnrequest.split('SAMLRequest').last
   end
+  let(:raw_vtr_proofing_authn_request) do
+    vtr_proofing_authn_request = saml_authn_request_url(
+      overrides: {
+        issuer: sp1_issuer,
+        authn_context: 'C1.C2.P1',
+      },
+    )
+    CGI.unescape vtr_proofing_authn_request.split('SAMLRequest').last
+  end
   let(:raw_ial1_aal3_authn_request) do
     ial1_aal3_authnrequest = saml_authn_request_url(
       overrides: {
@@ -95,6 +113,12 @@
   let(:ial2_authn_request) do
     SamlIdp::Request.from_deflated_request(raw_ial2_authn_request)
   end
+  let(:vtr_proofing_authn_request) do
+    SamlIdp::Request.from_deflated_request(raw_vtr_proofing_authn_request)
+  end
+  let(:vtr_no_proofing_authn_request) do
+    SamlIdp::Request.from_deflated_request(raw_vtr_no_proofing_authn_request)
+  end
   let(:ial1_aal3_authn_request) do
     SamlIdp::Request.from_deflated_request(raw_ial1_aal3_authn_request)
   end
@@ -295,6 +319,34 @@
       end
     end
 
+    context 'verified user and proofing VTR request' do
+      let(:subject) do
+        described_class.new(
+          user: user,
+          name_id_format: name_id_format,
+          service_provider: service_provider,
+          authn_request: vtr_proofing_authn_request,
+          decrypted_pii: decrypted_pii,
+          user_session: user_session,
+        )
+      end
+
+      before do
+        user.identities << identity
+        allow(service_provider.metadata).to receive(:[]).with(:attribute_bundle).
+          and_return(%w[email first_name last_name])
+        subject.build
+      end
+
+      it 'includes the correct bundle attributes' do
+        expect(user.asserted_attributes.keys).to eq(
+          [:uuid, :email, :first_name, :last_name, :verified_at, :vot],
+        )
+        expect(user.asserted_attributes[:first_name][:getter].call(user)).to eq 'Jåné'
+        expect(user.asserted_attributes[:vot][:getter].call(user)).to eq 'C1.C2.P1'
+      end
+    end
+
     context 'verified user and IAL1 request' do
       let(:subject) do
         described_class.new(
@@ -454,6 +506,33 @@
           end
         end
       end
+
+      context 'request made with a VTR param' do
+        let(:subject) do
+          described_class.new(
+            user: user,
+            name_id_format: name_id_format,
+            service_provider: service_provider,
+            authn_request: vtr_no_proofing_authn_request,
+            decrypted_pii: decrypted_pii,
+            user_session: user_session,
+          )
+        end
+
+        before do
+          user.identities << identity
+          allow(service_provider.metadata).to receive(:[]).with(:attribute_bundle).
+            and_return(%w[email])
+          subject.build
+        end
+
+        it 'includes the correct bundle attributes' do
+          expect(user.asserted_attributes.keys).to eq(
+            [:uuid, :email, :vot],
+          )
+          expect(user.asserted_attributes[:vot][:getter].call(user)).to eq 'C1.C2'
+        end
+      end
     end
 
     context 'verified user and IAL1 AAL3 request' do

From 173fa96932d2fc43e2174d5e8a32ef818e88c0c3 Mon Sep 17 00:00:00 2001
From: dawei-nava <130466753+dawei-nava@users.noreply.github.com>
Date: Mon, 11 Mar 2024 10:36:59 -0400
Subject: [PATCH 10/13] LG-12122: update selfie hint text translations.
 (#10213)

changelog: User-Facing Improvements, Doc Auth, Update selfie hint text translations.
---
 config/locales/doc_auth/es.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/locales/doc_auth/es.yml b/config/locales/doc_auth/es.yml
index 1902a1f4b41..7c055493f06 100644
--- a/config/locales/doc_auth/es.yml
+++ b/config/locales/doc_auth/es.yml
@@ -264,9 +264,9 @@ es:
         modificar su información.
       selfie_capture_status:
         face_close_to_border: DEMASIADO CERCA DEL MARCO
-        face_not_found: NO SE ENCONTRÓ LA CARA
-        face_too_small: LA CARA ES DEMASIADO CHICA
-        too_many_faces: HAY DEMASIADAS CARAS
+        face_not_found: NO SE DETECTÓ EL ROSTRO
+        face_too_small: ROSTRO DEMASIADO PEQUEÑO
+        too_many_faces: DEMASIADOS ROSTROS
       ssn: Necesitamos su número de Seguro Social para validar su nombre, fecha de
         nacimiento y dirección.
       tag: Recomendado

From 7d662c5445d208b52dd5bc4968350fe7dcfe12c7 Mon Sep 17 00:00:00 2001
From: John Maxwell <john.maxwell@gsa.gov>
Date: Mon, 11 Mar 2024 11:09:37 -0400
Subject: [PATCH 11/13] LG-12492 Update getting started screen for legacy
 selfies (#10207)

Updated with new text, and pulled out a new presenter WelcomeScreenPresenter.

changelog: Upcoming features,biometrics,Getting started screen for step-up selfies
---
 app/controllers/idv/welcome_controller.rb     |   3 +-
 app/presenters/idv/welcome_presenter.rb       |  82 +++++++++++
 app/views/idv/welcome/show.html.erb           |  44 ++----
 config/locales/doc_auth/en.yml                |   2 +
 config/locales/doc_auth/es.yml                |   2 +
 config/locales/doc_auth/fr.yml                |   2 +
 spec/features/idv/end_to_end_idv_spec.rb      |   7 +
 spec/features/idv/step_up_spec.rb             |   8 ++
 spec/presenters/idv/welcome_presenter_spec.rb | 136 ++++++++++++++++++
 spec/views/idv/welcome/show.html.erb_spec.rb  |  41 +++---
 10 files changed, 279 insertions(+), 48 deletions(-)
 create mode 100644 app/presenters/idv/welcome_presenter.rb
 create mode 100644 spec/presenters/idv/welcome_presenter_spec.rb

diff --git a/app/controllers/idv/welcome_controller.rb b/app/controllers/idv/welcome_controller.rb
index 77e84bbb04d..ba1754d6b31 100644
--- a/app/controllers/idv/welcome_controller.rb
+++ b/app/controllers/idv/welcome_controller.rb
@@ -12,8 +12,7 @@ def show
       Funnel::DocAuth::RegisterStep.new(current_user.id, sp_session[:issuer]).
         call('welcome', :view, true)
 
-      @sp_name = decorated_sp_session.sp_name || APP_NAME
-      @title = t('doc_auth.headings.welcome', sp_name: @sp_name)
+      @presenter = Idv::WelcomePresenter.new(decorated_sp_session)
     end
 
     def update
diff --git a/app/presenters/idv/welcome_presenter.rb b/app/presenters/idv/welcome_presenter.rb
new file mode 100644
index 00000000000..6f938c937a5
--- /dev/null
+++ b/app/presenters/idv/welcome_presenter.rb
@@ -0,0 +1,82 @@
+module Idv
+  class WelcomePresenter
+    include ActionView::Helpers::TranslationHelper
+    include Rails.application.routes.url_helpers
+    include LinkHelper
+    include ActionView::Helpers::UrlHelper
+
+    attr_accessor :url_options
+
+    def initialize(decorated_sp_session)
+      @decorated_sp_session = decorated_sp_session
+      @url_options = {}
+    end
+
+    def sp_name
+      decorated_sp_session.sp_name || APP_NAME
+    end
+
+    def title
+      t('doc_auth.headings.welcome', sp_name: sp_name)
+    end
+
+    def selfie_required?
+      decorated_sp_session.selfie_required?
+    end
+
+    def explanation_text(help_link)
+      if selfie_required?
+        t(
+          'doc_auth.info.stepping_up_html',
+          sp_name:,
+          link_html: help_link,
+        )
+      else
+        t(
+          'doc_auth.info.getting_started_html',
+          sp_name: sp_name,
+          link_html: help_link,
+        )
+      end
+    end
+
+    def bullet_points
+      [
+        if selfie_required?
+          bullet_point(
+            t('doc_auth.instructions.bullet1_with_selfie'),
+            t('doc_auth.instructions.text1_with_selfie'),
+          )
+        else
+          bullet_point(
+            t('doc_auth.instructions.bullet1'),
+            t('doc_auth.instructions.text1'),
+          )
+        end,
+
+        bullet_point(
+          t('doc_auth.instructions.bullet2'),
+          t('doc_auth.instructions.text2'),
+        ),
+
+        bullet_point(
+          t('doc_auth.instructions.bullet3'),
+          t('doc_auth.instructions.text3'),
+        ),
+
+        bullet_point(
+          t('doc_auth.instructions.bullet4', app_name: sp_name),
+          t('doc_auth.instructions.text4'),
+        ),
+      ]
+    end
+
+    private
+
+    attr_accessor :decorated_sp_session
+
+    def bullet_point(bullet, text)
+      OpenStruct.new(bullet: bullet, text: text)
+    end
+  end
+end
diff --git a/app/views/idv/welcome/show.html.erb b/app/views/idv/welcome/show.html.erb
index 0ce1009fd3c..950e6f58096 100644
--- a/app/views/idv/welcome/show.html.erb
+++ b/app/views/idv/welcome/show.html.erb
@@ -1,15 +1,13 @@
-<% self.title = @title %>
+<% self.title = @presenter.title %>
 <%= render JavascriptRequiredComponent.new(
       header: t('idv.welcome.no_js_header'),
-      intro: t('idv.welcome.no_js_intro', sp_name: @sp_name),
+      intro: t('idv.welcome.no_js_intro', sp_name: @presenter.sp_name),
       location: :idv_welcome,
     ) do %>
-<%= render PageHeadingComponent.new.with_content(@title) %>
+<%= render PageHeadingComponent.new.with_content(@presenter.title) %>
   <p>
-    <%= t(
-          'doc_auth.info.getting_started_html',
-          sp_name: @sp_name,
-          link_html: new_tab_link_to(
+    <%= @presenter.explanation_text(
+          new_tab_link_to(
             t('doc_auth.info.getting_started_learn_more'),
             help_center_redirect_path(
               category: 'verify-your-identity',
@@ -25,31 +23,19 @@
   <h2><%= t('doc_auth.instructions.getting_started') %></h2>
 
   <%= render ProcessListComponent.new(heading_level: :h3, class: 'margin-y-3') do |c| %>
-    <% if decorated_sp_session.selfie_required? %>
-      <%= c.with_item(heading: t('doc_auth.instructions.bullet1_with_selfie')) do %>
-        <p><%= t('doc_auth.instructions.text1_with_selfie') %></p>
+    <% @presenter.bullet_points.each do |point| %>
+      <%= c.with_item(heading: point.bullet) do %>
+        <p><%= point.text %></p>
       <% end %>
-    <% else %>
-      <%= c.with_item(heading: t('doc_auth.instructions.bullet1')) do %>
-        <p><%= t('doc_auth.instructions.text1') %></p>
-      <% end %>
-    <% end %>
-    <%= c.with_item(heading: t('doc_auth.instructions.bullet2')) do %>
-      <p><%= t('doc_auth.instructions.text2') %></p>
-    <% end %>
-    <%= c.with_item(heading: t('doc_auth.instructions.bullet3')) do %>
-      <p><%= t('doc_auth.instructions.text3') %></p>
-    <% end %>
-    <%= c.with_item(heading: t('doc_auth.instructions.bullet4', app_name: APP_NAME)) do %>
-      <p><%= t('doc_auth.instructions.text4') %></p>
     <% end %>
   <% end %>
-<%= simple_form_for(
-      :doc_auth,
-      url: url_for,
-      method: 'put',
-      html: { autocomplete: 'off', class: 'margin-top-2 margin-bottom-5 js-consent-continue-form' },
-    ) do |f| %>
+
+  <%= simple_form_for(
+        :doc_auth,
+        url: url_for,
+        method: 'put',
+        html: { autocomplete: 'off', class: 'margin-top-2 margin-bottom-5 js-consent-continue-form' },
+      ) do |f| %>
 
   <div class="margin-top-4">
     <%= render(
diff --git a/config/locales/doc_auth/en.yml b/config/locales/doc_auth/en.yml
index 831d908172f..a5d5dd2d1f0 100644
--- a/config/locales/doc_auth/en.yml
+++ b/config/locales/doc_auth/en.yml
@@ -231,6 +231,8 @@ en:
         too_many_faces: TOO MANY FACES
       ssn: We need your Social Security number to verify your name, date of birth and
         address.
+      stepping_up_html: 'Verify your identity again and take a photo of yourself to
+        access this service. %{link_html}'
       tag: Recommended
       upload_from_computer: Don’t have a phone? Upload photos of your ID from this computer.
       upload_from_phone: You won’t have to sign in again, and you’ll switch back to
diff --git a/config/locales/doc_auth/es.yml b/config/locales/doc_auth/es.yml
index 7c055493f06..b6bd473dae3 100644
--- a/config/locales/doc_auth/es.yml
+++ b/config/locales/doc_auth/es.yml
@@ -269,6 +269,8 @@ es:
         too_many_faces: DEMASIADOS ROSTROS
       ssn: Necesitamos su número de Seguro Social para validar su nombre, fecha de
         nacimiento y dirección.
+      stepping_up_html: 'Verifica tu identidad de nuevo y tómate una foto para acceder
+        a este servicio. %{link_html}'
       tag: Recomendado
       upload_from_computer: ¿No tiene teléfono? Suba fotos de su documento de
         identidad desde esta computadora.
diff --git a/config/locales/doc_auth/fr.yml b/config/locales/doc_auth/fr.yml
index 5928afcc3a0..68ac732127a 100644
--- a/config/locales/doc_auth/fr.yml
+++ b/config/locales/doc_auth/fr.yml
@@ -279,6 +279,8 @@ fr:
         too_many_faces: TROP DE VISAGES
       ssn: Nous avons besoin de votre numéro de sécurité sociale pour vérifier votre
         nom, date de naissance et adresse.
+      stepping_up_html: 'Vérifiez à nouveau votre identité et prenez une photo de vous
+        pour accéder à ce service. %{link_html}'
       tag: Recommandation
       upload_from_computer: Vous n’avez pas de téléphone ? Téléchargez les photos de
         votre carte d’identité depuis cet ordinateur.
diff --git a/spec/features/idv/end_to_end_idv_spec.rb b/spec/features/idv/end_to_end_idv_spec.rb
index 397021e9937..43a610fab01 100644
--- a/spec/features/idv/end_to_end_idv_spec.rb
+++ b/spec/features/idv/end_to_end_idv_spec.rb
@@ -150,6 +150,13 @@ def validate_welcome_page
     expect(page).to have_current_path(idv_welcome_path)
 
     expect(page).to have_content t('doc_auth.headings.welcome', sp_name: sp_name)
+
+    stepping_up_info_message = t(
+      'doc_auth.info.stepping_up_html',
+      sp_name: sp.name,
+      link_html: '',
+    )
+    expect(page).not_to have_content(stepping_up_info_message)
   end
 
   def validate_agreement_page
diff --git a/spec/features/idv/step_up_spec.rb b/spec/features/idv/step_up_spec.rb
index 3085068aa52..62c79364c72 100644
--- a/spec/features/idv/step_up_spec.rb
+++ b/spec/features/idv/step_up_spec.rb
@@ -21,6 +21,14 @@
 
     expect(page).to have_current_path(idv_welcome_path)
 
+    stepping_up_info_message = t(
+      'doc_auth.info.stepping_up_html',
+      sp_name: sp.name,
+      link_html: '',
+    )
+
+    expect(page).to have_content(stepping_up_info_message)
+
     complete_proofing_steps(with_selfie: true)
   end
 
diff --git a/spec/presenters/idv/welcome_presenter_spec.rb b/spec/presenters/idv/welcome_presenter_spec.rb
new file mode 100644
index 00000000000..2cb0fe29c76
--- /dev/null
+++ b/spec/presenters/idv/welcome_presenter_spec.rb
@@ -0,0 +1,136 @@
+require 'rails_helper'
+
+RSpec.describe Idv::WelcomePresenter do
+  subject(:presenter) { Idv::WelcomePresenter.new(decorated_sp_session) }
+
+  let(:sp) { build(:service_provider) }
+
+  let(:sp_session) { {} }
+
+  let(:decorated_sp_session) do
+    ServiceProviderSession.new(
+      sp: sp,
+      view_context: nil,
+      sp_session: sp_session,
+      service_provider_request: nil,
+    )
+  end
+
+  it 'gives us the correct sp_name' do
+    expect(presenter.sp_name).to eq(sp.friendly_name)
+  end
+
+  it 'gives us the correct title' do
+    expect(presenter.title).to eq(t('doc_auth.headings.welcome', sp_name: sp.friendly_name))
+  end
+
+  describe 'the explanation' do
+    let(:help_link) { '<a href="https://www.example.com>Learn more about verifying your identity</a>' }
+
+    context 'when a selfie is not required' do
+      it 'uses the getting started message' do
+        expect(presenter.explanation_text(help_link)).to eq(
+          t(
+            'doc_auth.info.getting_started_html',
+            sp_name: sp.friendly_name,
+            link_html: help_link,
+          ),
+        )
+      end
+    end
+
+    context 'when a selfie is required' do
+      let(:sp_session) do
+        { biometric_comparison_required: true }
+      end
+
+      before do
+        allow(IdentityConfig.store).to receive(:doc_auth_selfie_capture_enabled).and_return(true)
+      end
+
+      it 'uses the stepping up message' do
+        expect(presenter.explanation_text(help_link)).to eq(
+          t(
+            'doc_auth.info.stepping_up_html',
+            sp_name: sp.friendly_name,
+            link_html: help_link,
+          ),
+        )
+      end
+    end
+  end
+
+  describe 'the bullet points' do
+    context 'when a selfie is not required' do
+      it 'uses the no selfie bullet point 1 header' do
+        expect(presenter.bullet_points[0].bullet).to eq(
+          t('doc_auth.instructions.bullet1'),
+        )
+      end
+
+      it 'uses the no selfie bullet point 1 text' do
+        expect(presenter.bullet_points[0].text).to eq(
+          t('doc_auth.instructions.text1'),
+        )
+      end
+    end
+
+    context 'when a selfie is required' do
+      let(:sp_session) do
+        { biometric_comparison_required: true }
+      end
+
+      before do
+        allow(IdentityConfig.store).to receive(:doc_auth_selfie_capture_enabled).and_return(true)
+      end
+
+      it 'uses the selfie bullet point 1 header' do
+        expect(presenter.bullet_points[0].bullet).to eq(
+          t('doc_auth.instructions.bullet1_with_selfie'),
+        )
+      end
+
+      it 'uses the selfie bullet point 1 text' do
+        expect(presenter.bullet_points[0].text).to eq(
+          t('doc_auth.instructions.text1_with_selfie'),
+        )
+      end
+    end
+
+    it 'shows the bullet point 2 header' do
+      expect(presenter.bullet_points[1].bullet).to eq(
+        t('doc_auth.instructions.bullet2'),
+      )
+    end
+
+    it 'shows the bullet point 2 text' do
+      expect(presenter.bullet_points[1].text).to eq(
+        t('doc_auth.instructions.text2'),
+      )
+    end
+
+    it 'shows the bullet point 3 header' do
+      expect(presenter.bullet_points[2].bullet).to eq(
+        t('doc_auth.instructions.bullet3'),
+      )
+    end
+
+    it 'shows the bullet point 3 text' do
+      expect(presenter.bullet_points[2].text).to eq(
+        t('doc_auth.instructions.text3'),
+      )
+    end
+
+    it 'shows the bullet point 4 header' do
+      expect(presenter.bullet_points[3].bullet).to eq(
+        t('doc_auth.instructions.bullet4', app_name: sp.friendly_name),
+      )
+    end
+
+    it 'shows the bullet point 4 text' do
+      expect(presenter.bullet_points[3].text).to eq(
+        t('doc_auth.instructions.text4'),
+      )
+    end
+  end
+end
diff --git a/spec/views/idv/welcome/show.html.erb_spec.rb b/spec/views/idv/welcome/show.html.erb_spec.rb
index 12cd6916e6c..516365708b4 100644
--- a/spec/views/idv/welcome/show.html.erb_spec.rb
+++ b/spec/views/idv/welcome/show.html.erb_spec.rb
@@ -1,25 +1,26 @@
 require 'rails_helper'
 
 RSpec.describe 'idv/welcome/show.html.erb' do
-  let(:user_fully_authenticated) { true }
-  let(:sp_name) { nil }
+  include Devise::Test::ControllerHelpers
+
   let(:selfie_required) { false }
+  let(:selfie_capture_enabled) { false }
   let(:user) { create(:user) }
+  let(:sp_session) { {} }
 
   before do
-    @decorated_sp_session = instance_double(ServiceProviderSession)
-    allow(@decorated_sp_session).to receive(:sp_name).and_return(sp_name)
-    allow(@decorated_sp_session).to receive(:selfie_required?).and_return(selfie_required)
-    @sp_name = @decorated_sp_session.sp_name || APP_NAME
-    @title = t('doc_auth.headings.welcome', sp_name: @sp_name)
-    allow(view).to receive(:decorated_sp_session).and_return(@decorated_sp_session)
-    allow(view).to receive(:user_fully_authenticated?).and_return(user_fully_authenticated)
-    allow(view).to receive(:user_signing_up?).and_return(false)
-    allow(view).to receive(:url_for).and_wrap_original do |method, *args, &block|
-      method.call(*args, &block)
-    rescue
-      ''
-    end
+    sp = build(:service_provider)
+    decorated_sp_session = ServiceProviderSession.new(
+      sp: sp,
+      view_context: nil,
+      sp_session: sp_session,
+      service_provider_request: nil,
+    )
+    presenter = Idv::WelcomePresenter.new(decorated_sp_session)
+    assign(:presenter, presenter)
+
+    allow(IdentityConfig.store).to receive(:doc_auth_selfie_capture_enabled).
+      and_return(selfie_capture_enabled)
   end
 
   context 'in doc auth with an authenticated user' do
@@ -33,7 +34,9 @@
     end
 
     it 'renders the welcome template' do
-      expect(rendered).to have_content(@title)
+      expect(rendered).to have_content(
+        t('doc_auth.headings.welcome', sp_name: 'Test Service Provider'),
+      )
       expect(rendered).to have_content(t('doc_auth.instructions.getting_started'))
       expect(rendered).to have_content(t('doc_auth.instructions.bullet1'))
       expect(rendered).to have_link(
@@ -49,7 +52,11 @@
     end
 
     context 'when the SP requests IAL2 verification' do
-      let(:selfie_required) { true }
+      let(:sp_session) do
+        { biometric_comparison_required: true }
+      end
+
+      let(:selfie_capture_enabled) { true }
 
       it 'renders a modified welcome template' do
         expect(rendered).to have_content(t('doc_auth.instructions.bullet1_with_selfie'))

From bb023074c63574a08c4de623adc9097a97f2abcc Mon Sep 17 00:00:00 2001
From: John Maxwell <john.maxwell@gsa.gov>
Date: Mon, 11 Mar 2024 11:11:51 -0400
Subject: [PATCH 12/13] LG-12563 add vot to user info controller (#10215)

Changed oidc user info endpoint to include vot information when requested.

changelog: Upcoming features,VoT,Added Vot to oidc user info

---------

Co-authored-by: Zach Margolis <zachmargolis@users.noreply.github.com>
---
 .../openid_connect_user_info_presenter.rb     |  15 +-
 app/services/id_token_builder.rb              |  13 +-
 app/services/vot/parser.rb                    |   4 +
 .../openid_connect/openid_connect_spec.rb     |  28 +-
 spec/features/openid_connect/vtr_spec.rb      |  12 +-
 ...openid_connect_user_info_presenter_spec.rb | 423 ++++++++++--------
 spec/services/id_token_builder_spec.rb        |  38 --
 spec/support/oidc_auth_helper.rb              |   2 +-
 8 files changed, 280 insertions(+), 255 deletions(-)

diff --git a/app/presenters/openid_connect_user_info_presenter.rb b/app/presenters/openid_connect_user_info_presenter.rb
index ec1ce58ff0a..f29698b24f8 100644
--- a/app/presenters/openid_connect_user_info_presenter.rb
+++ b/app/presenters/openid_connect_user_info_presenter.rb
@@ -21,8 +21,13 @@ def user_info
     info.merge!(ial2_attributes) if scoper.ial2_scopes_requested? && ial2_data.present?
     info.merge!(x509_attributes) if scoper.x509_scopes_requested?
     info[:verified_at] = verified_at if scoper.verified_at_requested?
-    info[:ial] = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
-    info[:aal] = identity.requested_aal_value
+    if identity.vtr.nil?
+      info[:ial] = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
+      info[:aal] = identity.requested_aal_value
+    else
+      info[:vot] = vot_values
+      info[:vtm] = IdentityConfig.store.vtm_url
+    end
 
     scoper.filter(info)
   end
@@ -33,6 +38,12 @@ def url_options
 
   private
 
+  def vot_values
+    vot = JSON.parse(identity.vtr).first
+    parsed_vot = Vot::Parser.new(vector_of_trust: vot).parse
+    parsed_vot.expanded_component_values
+  end
+
   def uuid_from_sp_identity(identity)
     AgencyIdentityLinker.new(identity).link_identity.uuid
   end
diff --git a/app/services/id_token_builder.rb b/app/services/id_token_builder.rb
index 96e7f60a377..482c5c0a0cf 100644
--- a/app/services/id_token_builder.rb
+++ b/app/services/id_token_builder.rb
@@ -36,16 +36,19 @@ def jwt_payload
   end
 
   def id_token_claims
-    {
-      acr: (acr if !sp_requests_vot?),
-      vot: (vot if sp_requests_vot?),
-      vtm: (IdentityConfig.store.vtm_url if sp_requests_vot?),
+    claims = {
       nonce: identity.nonce,
       aud: identity.service_provider,
       jti: SecureRandom.urlsafe_base64,
       at_hash: hash_token(identity.access_token),
       c_hash: hash_token(code),
-    }.compact
+    }
+
+    if !sp_requests_vot?
+      claims[:acr] = acr
+    end
+
+    claims
   end
 
   def timestamp_claims
diff --git a/app/services/vot/parser.rb b/app/services/vot/parser.rb
index 917415fb2bc..8073e8374fa 100644
--- a/app/services/vot/parser.rb
+++ b/app/services/vot/parser.rb
@@ -26,6 +26,10 @@ def self.no_sp_result
       def identity_proofing_or_ialmax?
         identity_proofing? || ialmax?
       end
+
+      def expanded_component_values
+        component_values.map(&:name).join('.')
+      end
     end
 
     attr_reader :vector_of_trust, :acr_values
diff --git a/spec/features/openid_connect/openid_connect_spec.rb b/spec/features/openid_connect/openid_connect_spec.rb
index 71e8aeda989..5d4df2f405c 100644
--- a/spec/features/openid_connect/openid_connect_spec.rb
+++ b/spec/features/openid_connect/openid_connect_spec.rb
@@ -27,7 +27,7 @@
 
   context 'with client_secret_jwt' do
     it 'succeeds with prompt login and no prior session' do
-      oidc_end_client_secret_jwt(vtr: 'C1.C2.P1', prompt: 'login')
+      oidc_end_client_secret_jwt(vot: 'C1.C2.P1', prompt: 'login')
     end
 
     it 'succeeds in forcing login with prompt login and prior session' do
@@ -58,8 +58,7 @@
     end
 
     it 'succeeds with a vtr param' do
-      allow(IdentityConfig.store).to receive(:use_vot_in_sp_requests).and_return(true)
-      oidc_end_client_secret_jwt(vtr: 'C1.C2.P1')
+      oidc_end_client_secret_jwt(vot: 'C1.C2.P1')
     end
   end
 
@@ -1159,14 +1158,14 @@ def client_private_key
     end
   end
 
-  def oidc_end_client_secret_jwt(vtr: nil, prompt: nil, user: nil, redirs_to: nil)
+  def oidc_end_client_secret_jwt(vot: nil, prompt: nil, user: nil, redirs_to: nil)
     client_id = 'urn:gov:gsa:openidconnect:sp:server'
     state = SecureRandom.hex
     nonce = SecureRandom.hex
 
-    if vtr.present?
+    if vot.present?
       visit_idp_from_oidc_sp_with_vtr(
-        vtr: vtr,
+        vtr: [vot],
         prompt: prompt,
         state: state,
         nonce: nonce,
@@ -1234,9 +1233,9 @@ def oidc_end_client_secret_jwt(vtr: nil, prompt: nil, user: nil, redirs_to: nil)
     expect(decoded_id_token[:given_name]).to eq('John')
     expect(decoded_id_token[:social_security_number]).to eq('111223333')
 
-    if vtr.present?
+    if vot.present?
       expect(decoded_id_token[:acr]).to eq(nil)
-      expect(decoded_id_token[:vot]).to eq(Array(vtr).first)
+      expect(decoded_id_token[:vot]).to eq(vot)
     else
       expect(decoded_id_token[:acr]).to eq(Saml::Idp::Constants::IAL2_AUTHN_CONTEXT_CLASSREF)
       expect(decoded_id_token[:vot]).to eq(nil)
@@ -1254,6 +1253,19 @@ def oidc_end_client_secret_jwt(vtr: nil, prompt: nil, user: nil, redirs_to: nil)
     expect(userinfo_response[:email]).to eq(user.email)
     expect(userinfo_response[:given_name]).to eq('John')
     expect(userinfo_response[:social_security_number]).to eq('111223333')
+
+    if vot.present?
+      expect(userinfo_response).not_to have_key(:ial)
+      expect(userinfo_response).not_to have_key(:aal)
+      expect(userinfo_response[:vot]).to eq(vot)
+    else
+      expect(userinfo_response[:ial]).to eq(Saml::Idp::Constants::IAL2_AUTHN_CONTEXT_CLASSREF)
+      expect(userinfo_response[:aal]).to eq(
+        Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF,
+      )
+      expect(userinfo_response).not_to have_key(:vot)
+    end
+
     user
   end
 end
diff --git a/spec/features/openid_connect/vtr_spec.rb b/spec/features/openid_connect/vtr_spec.rb
index c505f37c6a7..90db1c7d821 100644
--- a/spec/features/openid_connect/vtr_spec.rb
+++ b/spec/features/openid_connect/vtr_spec.rb
@@ -13,7 +13,7 @@
   scenario 'sign in with VTR request for authentication', :js do
     user = create(:user, :fully_registered)
 
-    visit_idp_from_oidc_sp_with_vtr(vtr: 'C1')
+    visit_idp_from_oidc_sp_with_vtr(vtr: ['C1'])
 
     expect(page).to have_content(t('headings.sign_in_existing_users'))
 
@@ -38,7 +38,7 @@
     click_submit_default
     first(:button, t('links.sign_out')).click
 
-    visit_idp_from_oidc_sp_with_vtr(vtr: 'C1.C2')
+    visit_idp_from_oidc_sp_with_vtr(vtr: ['C1.C2'])
     sign_in_user(user)
 
     # MFA is required despite remember device
@@ -55,7 +55,7 @@
     mock_webauthn_setup_challenge
     user = create(:user, :fully_registered)
 
-    visit_idp_from_oidc_sp_with_vtr(vtr: 'C1.Ca')
+    visit_idp_from_oidc_sp_with_vtr(vtr: ['C1.Ca'])
     sign_in_live_with_2fa(user)
 
     # More secure MFA is required
@@ -80,7 +80,7 @@
 
     user = create(:user, :fully_registered)
 
-    visit_idp_from_oidc_sp_with_vtr(vtr: 'C1.Cb')
+    visit_idp_from_oidc_sp_with_vtr(vtr: ['C1.Cb'])
     sign_in_live_with_2fa(user)
 
     # More secure MFA is required
@@ -107,7 +107,7 @@
   scenario 'sign in with VTR request for idv requires idv', :js do
     user = create(:user, :fully_registered)
 
-    visit_idp_from_oidc_sp_with_vtr(vtr: 'P1')
+    visit_idp_from_oidc_sp_with_vtr(vtr: ['P1'])
 
     expect(page).to have_content(t('headings.sign_in_existing_users'))
 
@@ -121,7 +121,7 @@
 
     user = create(:user, :fully_registered)
 
-    visit_idp_from_oidc_sp_with_vtr(vtr: 'Pb')
+    visit_idp_from_oidc_sp_with_vtr(vtr: ['Pb'])
 
     expect(page).to have_content(t('headings.sign_in_existing_users'))
 
diff --git a/spec/presenters/openid_connect_user_info_presenter_spec.rb b/spec/presenters/openid_connect_user_info_presenter_spec.rb
index 2b3a48073ba..ee44d0af503 100644
--- a/spec/presenters/openid_connect_user_info_presenter_spec.rb
+++ b/spec/presenters/openid_connect_user_info_presenter_spec.rb
@@ -27,258 +27,291 @@
   describe '#user_info' do
     subject(:user_info) { presenter.user_info }
 
-    context 'basic ial1' do
-      it 'has basic attributes' do
-        ial = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
-        aal = Saml::Idp::Constants::AAL2_HSPD12_AUTHN_CONTEXT_CLASSREF
+    context 'without a vtr parameter' do
+      context 'basic ial1' do
+        it 'has basic attributes' do
+          ial = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
+          aal = Saml::Idp::Constants::AAL2_HSPD12_AUTHN_CONTEXT_CLASSREF
 
-        aggregate_failures do
-          expect(user_info[:sub]).to eq(identity.uuid)
-          expect(user_info[:iss]).to eq(root_url)
-          expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
-          expect(user_info[:email_verified]).to eq(true)
-          expect(user_info[:all_emails]).to eq([identity.user.email_addresses.first.email])
-          expect(user_info[:ial]).to eq(ial)
-          expect(user_info[:aal]).to eq(aal)
+          aggregate_failures do
+            expect(user_info[:sub]).to eq(identity.uuid)
+            expect(user_info[:iss]).to eq(root_url)
+            expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
+            expect(user_info[:email_verified]).to eq(true)
+            expect(user_info[:all_emails]).to eq([identity.user.email_addresses.first.email])
+            expect(user_info[:ial]).to eq(ial)
+            expect(user_info[:aal]).to eq(aal)
+            expect(user_info).not_to have_key(:vot)
+          end
         end
       end
-    end
 
-    context 'ialmax' do
-      let(:ial) { Idp::Constants::IAL_MAX }
-      let(:ial_value) { Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[ial] }
-      let(:aal) { Saml::Idp::Constants::AAL2_HSPD12_AUTHN_CONTEXT_CLASSREF }
-      before { identity.ial = ial }
+      context 'ialmax' do
+        let(:ial) { Idp::Constants::IAL_MAX }
+        let(:ial_value) { Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[ial] }
+        let(:aal) { Saml::Idp::Constants::AAL2_HSPD12_AUTHN_CONTEXT_CLASSREF }
+        before { identity.ial = ial }
 
-      it 'has basic attributes' do
-        aggregate_failures do
-          expect(user_info[:sub]).to eq(identity.uuid)
-          expect(user_info[:iss]).to eq(root_url)
-          expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
-          expect(user_info[:email_verified]).to eq(true)
-          expect(user_info[:all_emails]).to eq([identity.user.email_addresses.first.email])
-          expect(user_info[:ial]).to eq(ial_value)
-          expect(user_info[:aal]).to eq(aal)
+        it 'has basic attributes' do
+          aggregate_failures do
+            expect(user_info[:sub]).to eq(identity.uuid)
+            expect(user_info[:iss]).to eq(root_url)
+            expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
+            expect(user_info[:email_verified]).to eq(true)
+            expect(user_info[:all_emails]).to eq([identity.user.email_addresses.first.email])
+            expect(user_info[:ial]).to eq(ial_value)
+            expect(user_info[:aal]).to eq(aal)
+            expect(user_info).not_to have_key(:vot)
+          end
         end
-      end
 
-      it 'does not return ial2 attributes' do
-        aggregate_failures do
-          expect(user_info[:given_name]).to eq(nil)
-          expect(user_info[:family_name]).to eq(nil)
-          expect(user_info[:birthdate]).to eq(nil)
-          expect(user_info[:phone]).to eq(nil)
-          expect(user_info[:phone_verified]).to eq(nil)
-          expect(user_info[:address]).to eq(nil)
+        it 'does not return ial2 attributes' do
+          aggregate_failures do
+            expect(user_info[:given_name]).to eq(nil)
+            expect(user_info[:family_name]).to eq(nil)
+            expect(user_info[:birthdate]).to eq(nil)
+            expect(user_info[:phone]).to eq(nil)
+            expect(user_info[:phone_verified]).to eq(nil)
+            expect(user_info[:address]).to eq(nil)
+            expect(user_info).not_to have_key(:vot)
+          end
         end
       end
-    end
 
-    context 'when a piv/cac was used as second factor' do
-      let(:x509) do
-        {
-          subject: x509_subject,
-        }
-      end
-
-      let(:x509_subject) { 'x509-subject' }
+      context 'when a piv/cac was used as second factor' do
+        let(:x509) do
+          {
+            subject: x509_subject,
+          }
+        end
 
-      before do
-        OutOfBandSessionAccessor.new(rails_session_id).put_x509(x509, 5.minutes.to_i)
-      end
+        let(:x509_subject) { 'x509-subject' }
 
-      context 'when the identity has piv/cac associated' do
-        let(:identity) do
-          build(
-            :service_provider_identity,
-            rails_session_id: rails_session_id,
-            user: create(:user, :with_piv_or_cac),
-            scope: scope,
-          )
+        before do
+          OutOfBandSessionAccessor.new(rails_session_id).put_x509(x509, 5.minutes.to_i)
         end
 
-        context 'when the scope includes all attributes' do
-          it 'returns x509 attributes' do
-            aggregate_failures do
-              expect(user_info[:x509_subject]).to eq(x509_subject)
-            end
+        context 'when the identity has piv/cac associated' do
+          let(:identity) do
+            build(
+              :service_provider_identity,
+              rails_session_id: rails_session_id,
+              user: create(:user, :with_piv_or_cac),
+              scope: scope,
+            )
           end
 
-          it 'renders values as simple strings as json' do
-            json = user_info.as_json
+          context 'when the scope includes all attributes' do
+            it 'returns x509 attributes' do
+              aggregate_failures do
+                expect(user_info[:x509_subject]).to eq(x509_subject)
+              end
+            end
+
+            it 'renders values as simple strings as json' do
+              json = user_info.as_json
 
-            expect(json['x509_subject']).to eq(x509_subject)
+              expect(json['x509_subject']).to eq(x509_subject)
+            end
           end
         end
-      end
 
-      context 'when the identity has no piv/cac associated' do
-        context 'when the scope includes all attributes' do
-          it 'returns no x509 attributes' do
-            aggregate_failures do
-              expect(user_info[:x509_subject]).to be_blank
+        context 'when the identity has no piv/cac associated' do
+          context 'when the scope includes all attributes' do
+            it 'returns no x509 attributes' do
+              aggregate_failures do
+                expect(user_info[:x509_subject]).to be_blank
+              end
             end
           end
         end
       end
-    end
 
-    context 'when there is decrypted ial2 session data in redis' do
-      let(:pii) do
-        {
-          first_name: 'John',
-          last_name: 'Smith',
-          dob: '12/31/1970',
-          address1: '123 Fake St',
-          address2: 'Apt 456',
-          city: 'Washington',
-          state: 'DC',
-          zipcode: '  12345-1234',
-          phone: '(703) 555-5555',
-          ssn: '666661234',
-        }
-      end
+      context 'when there is decrypted ial2 session data in redis' do
+        let(:pii) do
+          {
+            first_name: 'John',
+            last_name: 'Smith',
+            dob: '12/31/1970',
+            address1: '123 Fake St',
+            address2: 'Apt 456',
+            city: 'Washington',
+            state: 'DC',
+            zipcode: '  12345-1234',
+            phone: '(703) 555-5555',
+            ssn: '666661234',
+          }
+        end
 
-      before do
-        OutOfBandSessionAccessor.new(rails_session_id).put_pii(
-          profile_id: profile.id,
-          pii: pii,
-          expiration: 5.minutes.to_i,
-        )
-      end
+        before do
+          OutOfBandSessionAccessor.new(rails_session_id).put_pii(
+            profile_id: profile.id,
+            pii: pii,
+            expiration: 5.minutes.to_i,
+          )
+        end
 
-      context 'when the identity has ial2 access' do
-        before { identity.ial = Idp::Constants::IAL2 }
+        context 'when the identity has ial2 access' do
+          before { identity.ial = Idp::Constants::IAL2 }
+
+          context 'when the scope includes all attributes' do
+            it 'returns ial2 attributes' do
+              aggregate_failures do
+                expect(user_info[:given_name]).to eq('John')
+                expect(user_info[:family_name]).to eq('Smith')
+                expect(user_info[:birthdate]).to eq('1970-12-31')
+                expect(user_info[:phone]).to eq('+17035555555')
+                expect(user_info[:phone_verified]).to eq(true)
+                expect(user_info[:address]).to eq(
+                  formatted: "123 Fake St\nApt 456\nWashington, DC 12345",
+                  street_address: "123 Fake St\nApt 456",
+                  locality: 'Washington',
+                  region: 'DC',
+                  postal_code: '12345',
+                )
+                expect(user_info[:verified_at]).to eq(profile.verified_at.to_i)
+                expect(user_info[:social_security_number]).to eq('666661234')
+              end
+            end
 
-        context 'when the scope includes all attributes' do
-          it 'returns ial2 attributes' do
-            aggregate_failures do
-              expect(user_info[:given_name]).to eq('John')
-              expect(user_info[:family_name]).to eq('Smith')
-              expect(user_info[:birthdate]).to eq('1970-12-31')
-              expect(user_info[:phone]).to eq('+17035555555')
-              expect(user_info[:phone_verified]).to eq(true)
-              expect(user_info[:address]).to eq(
-                formatted: "123 Fake St\nApt 456\nWashington, DC 12345",
-                street_address: "123 Fake St\nApt 456",
-                locality: 'Washington',
-                region: 'DC',
-                postal_code: '12345',
-              )
-              expect(user_info[:verified_at]).to eq(profile.verified_at.to_i)
-              expect(user_info[:social_security_number]).to eq('666661234')
+            it 'renders values as simple strings as json' do
+              json = user_info.as_json
+
+              expect(json['given_name']).to eq('John')
             end
           end
 
-          it 'renders values as simple strings as json' do
-            json = user_info.as_json
+          context 'when the scope only includes minimal attributes' do
+            let(:scope) { 'openid email phone' }
+
+            it 'returns attributes allowed by the scope' do
+              aggregate_failures do
+                expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
+                expect(user_info[:email_verified]).to eq(true)
+                expect(user_info[:given_name]).to eq(nil)
+                expect(user_info[:family_name]).to eq(nil)
+                expect(user_info[:birthdate]).to eq(nil)
+                expect(user_info[:phone]).to eq('+17035555555')
+                expect(user_info[:phone_verified]).to eq(true)
+                expect(user_info[:address]).to eq(nil)
+                expect(user_info[:verified_at]).to eq(nil)
+                expect(user_info[:social_security_number]).to eq(nil)
+              end
+            end
+          end
+
+          context 'verified_at' do
+            let(:scope) { 'openid profile:verified_at' }
+
+            context 'when the service provider has ial1 access' do
+              let(:service_provider_ial) { 1 }
 
-            expect(json['given_name']).to eq('John')
+              it 'does not provide verified_at' do
+                expect(user_info[:verified_at]).to eq(nil)
+              end
+            end
+
+            context 'when the service provider has ial2 access' do
+              let(:service_provider_ial) { 2 }
+
+              it 'provides verified_at' do
+                expect(user_info[:verified_at]).to eq(profile.verified_at.to_i)
+              end
+            end
           end
         end
 
-        context 'when the scope only includes minimal attributes' do
-          let(:scope) { 'openid email phone' }
+        context 'when the identity only has ial1 access' do
+          before { identity.ial = Idp::Constants::IAL1 }
 
-          it 'returns attributes allowed by the scope' do
+          it 'does not return ial2 attributes' do
             aggregate_failures do
-              expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
-              expect(user_info[:email_verified]).to eq(true)
               expect(user_info[:given_name]).to eq(nil)
               expect(user_info[:family_name]).to eq(nil)
               expect(user_info[:birthdate]).to eq(nil)
-              expect(user_info[:phone]).to eq('+17035555555')
-              expect(user_info[:phone_verified]).to eq(true)
+              expect(user_info[:phone]).to eq(nil)
+              expect(user_info[:phone_verified]).to eq(nil)
               expect(user_info[:address]).to eq(nil)
-              expect(user_info[:verified_at]).to eq(nil)
-              expect(user_info[:social_security_number]).to eq(nil)
             end
           end
         end
 
-        context 'verified_at' do
-          let(:scope) { 'openid profile:verified_at' }
+        context 'when the identity has ialmax access' do
+          before { identity.ial = Idp::Constants::IAL_MAX }
+
+          context 'when the scope includes all attributes' do
+            it 'returns ial2 attributes' do
+              aggregate_failures do
+                expect(user_info[:given_name]).to eq('John')
+                expect(user_info[:family_name]).to eq('Smith')
+                expect(user_info[:birthdate]).to eq('1970-12-31')
+                expect(user_info[:phone]).to eq('+17035555555')
+                expect(user_info[:phone_verified]).to eq(true)
+                expect(user_info[:address]).to eq(
+                  formatted: "123 Fake St\nApt 456\nWashington, DC 12345",
+                  street_address: "123 Fake St\nApt 456",
+                  locality: 'Washington',
+                  region: 'DC',
+                  postal_code: '12345',
+                )
+                expect(user_info[:verified_at]).to eq(profile.verified_at.to_i)
+                expect(user_info[:social_security_number]).to eq('666661234')
+              end
+            end
 
-          context 'when the service provider has ial1 access' do
-            let(:service_provider_ial) { 1 }
+            it 'renders values as simple strings as json' do
+              json = user_info.as_json
 
-            it 'does not provide verified_at' do
-              expect(user_info[:verified_at]).to eq(nil)
+              expect(json['given_name']).to eq('John')
             end
           end
 
-          context 'when the service provider has ial2 access' do
-            let(:service_provider_ial) { 2 }
-
-            it 'provides verified_at' do
-              expect(user_info[:verified_at]).to eq(profile.verified_at.to_i)
+          context 'when the scope only includes minimal attributes' do
+            let(:scope) { 'openid email phone' }
+
+            it 'returns attributes allowed by the scope' do
+              aggregate_failures do
+                expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
+                expect(user_info[:email_verified]).to eq(true)
+                expect(user_info[:given_name]).to eq(nil)
+                expect(user_info[:family_name]).to eq(nil)
+                expect(user_info[:birthdate]).to eq(nil)
+                expect(user_info[:phone]).to eq('+17035555555')
+                expect(user_info[:phone_verified]).to eq(true)
+                expect(user_info[:address]).to eq(nil)
+                expect(user_info[:verified_at]).to eq(nil)
+                expect(user_info[:social_security_number]).to eq(nil)
+              end
             end
           end
         end
       end
+    end
 
-      context 'when the identity only has ial1 access' do
-        before { identity.ial = Idp::Constants::IAL1 }
-
-        it 'does not return ial2 attributes' do
-          aggregate_failures do
-            expect(user_info[:given_name]).to eq(nil)
-            expect(user_info[:family_name]).to eq(nil)
-            expect(user_info[:birthdate]).to eq(nil)
-            expect(user_info[:phone]).to eq(nil)
-            expect(user_info[:phone_verified]).to eq(nil)
-            expect(user_info[:address]).to eq(nil)
-          end
-        end
+    context 'with a vtr parameter' do
+      let(:identity) do
+        build(
+          :service_provider_identity,
+          rails_session_id: rails_session_id,
+          user: create(:user, profiles: [profile]),
+          service_provider: service_provider.issuer,
+          scope: scope,
+          aal: 2,
+          vtr: ['C1'],
+        )
       end
 
-      context 'when the identity has ialmax access' do
-        before { identity.ial = Idp::Constants::IAL_MAX }
-
-        context 'when the scope includes all attributes' do
-          it 'returns ial2 attributes' do
-            aggregate_failures do
-              expect(user_info[:given_name]).to eq('John')
-              expect(user_info[:family_name]).to eq('Smith')
-              expect(user_info[:birthdate]).to eq('1970-12-31')
-              expect(user_info[:phone]).to eq('+17035555555')
-              expect(user_info[:phone_verified]).to eq(true)
-              expect(user_info[:address]).to eq(
-                formatted: "123 Fake St\nApt 456\nWashington, DC 12345",
-                street_address: "123 Fake St\nApt 456",
-                locality: 'Washington',
-                region: 'DC',
-                postal_code: '12345',
-              )
-              expect(user_info[:verified_at]).to eq(profile.verified_at.to_i)
-              expect(user_info[:social_security_number]).to eq('666661234')
-            end
-          end
-
-          it 'renders values as simple strings as json' do
-            json = user_info.as_json
-
-            expect(json['given_name']).to eq('John')
-          end
-        end
-
-        context 'when the scope only includes minimal attributes' do
-          let(:scope) { 'openid email phone' }
-
-          it 'returns attributes allowed by the scope' do
-            aggregate_failures do
-              expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
-              expect(user_info[:email_verified]).to eq(true)
-              expect(user_info[:given_name]).to eq(nil)
-              expect(user_info[:family_name]).to eq(nil)
-              expect(user_info[:birthdate]).to eq(nil)
-              expect(user_info[:phone]).to eq('+17035555555')
-              expect(user_info[:phone_verified]).to eq(true)
-              expect(user_info[:address]).to eq(nil)
-              expect(user_info[:verified_at]).to eq(nil)
-              expect(user_info[:social_security_number]).to eq(nil)
-            end
-          end
+      it 'has basic attributes' do
+        aggregate_failures do
+          expect(user_info[:sub]).to eq(identity.uuid)
+          expect(user_info[:iss]).to eq(root_url)
+          expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
+          expect(user_info[:email_verified]).to eq(true)
+          expect(user_info[:all_emails]).to eq([identity.user.email_addresses.first.email])
+          expect(user_info).not_to have_key(:ial)
+          expect(user_info).not_to have_key(:aal)
+          expect(user_info[:vot]).to eq('C1')
+          expect(user_info[:vtm]).to eq(IdentityConfig.store.vtm_url)
         end
       end
     end
diff --git a/spec/services/id_token_builder_spec.rb b/spec/services/id_token_builder_spec.rb
index 39e546511b0..91de475f057 100644
--- a/spec/services/id_token_builder_spec.rb
+++ b/spec/services/id_token_builder_spec.rb
@@ -81,25 +81,6 @@
       end
     end
 
-    context 'vtr is disabled' do
-      before do
-        allow(IdentityConfig.store).to receive(:use_vot_in_sp_requests).
-          and_return(false)
-        allow(IdentityConfig.store).to receive(:vtm_url).
-          and_return(vtm_url)
-      end
-
-      it 'does not set the vot if the sp does not request it' do
-        identity.vtr = ['Pb'].to_json
-        expect(decoded_payload[:vot]).to eq nil
-      end
-
-      it 'does not set the vtm' do
-        identity.vtr = nil
-        expect(decoded_payload[:vtm]).to eq nil
-      end
-    end
-
     context 'context sp requests ACR values' do
       context 'aal and ial request' do
         before do
@@ -160,25 +141,6 @@
       end
     end
 
-    context 'sp requests includes ACR values and VTR' do
-      before do
-        allow(IdentityConfig.store).to receive(:use_vot_in_sp_requests).
-          and_return(true)
-        allow(IdentityConfig.store).to receive(:vtm_url).
-          and_return(vtm_url)
-
-        identity.ial = 1
-        identity.vtr = ['C1'].to_json
-        identity.acr_values = Saml::Idp::Constants::IAL1_AUTHN_CONTEXT_CLASSREF
-      end
-
-      it 'sets the vot and vtm and it does not set an acr' do
-        expect(decoded_payload[:vot]).to eq('C1')
-        expect(decoded_payload[:vtm]).to eq(vtm_url)
-        expect(decoded_payload[:acr]).to eq(nil)
-      end
-    end
-
     it 'sets the jti to something meaningful' do
       expect(decoded_payload[:jti]).to be_present
     end
diff --git a/spec/support/oidc_auth_helper.rb b/spec/support/oidc_auth_helper.rb
index 3c236979331..71a87ee3452 100644
--- a/spec/support/oidc_auth_helper.rb
+++ b/spec/support/oidc_auth_helper.rb
@@ -116,7 +116,7 @@ def vtr_params(
     vtr_params = {
       client_id: client_id,
       response_type: 'code',
-      vtr: Array(vtr).to_json,
+      vtr: vtr.to_json,
       scope: scope,
       redirect_uri: 'http://localhost:7654/auth/result',
       state: state,

From 5837343cd6c1a9fe3f78d56d9931808e108e80a0 Mon Sep 17 00:00:00 2001
From: Amir Reavis-Bey <amir.reavis-bey@gsa.gov>
Date: Mon, 11 Mar 2024 15:32:57 -0400
Subject: [PATCH 13/13] LG-12557: portrait match is received when not requested
 (#10193)

* fix session result bug when selfie is not requested

[skip changelog]

* selfie_status not_processed when selfie has not been requested

* define success for session result stub

* update test for document capture session result  success? alias

* rename liveness_enabled to match trueIDrespones arg name

* happy linting

* test that success? method returns success attribute value

* restore docauth mock selfie_status now that TrueIDRespnse#selfie_status only stores selfie_result when present and requested

* update comment for selfie_stauts return value
---
 .../lexis_nexis/responses/true_id_response.rb |   5 +-
 app/services/doc_auth/mock/result_response.rb |   2 +-
 .../document_capture_session_result.rb        |   7 +-
 .../document_capture_controller_spec.rb       |   1 +
 .../idv/doc_auth/document_capture_spec.rb     |  11 +-
 .../responses/true_id_response_spec.rb        | 211 +++++++++++-------
 .../document_capture_session_result_spec.rb   |  62 +----
 7 files changed, 149 insertions(+), 150 deletions(-)

diff --git a/app/services/doc_auth/lexis_nexis/responses/true_id_response.rb b/app/services/doc_auth/lexis_nexis/responses/true_id_response.rb
index b8c64a9f8d6..b6f5aee7570 100644
--- a/app/services/doc_auth/lexis_nexis/responses/true_id_response.rb
+++ b/app/services/doc_auth/lexis_nexis/responses/true_id_response.rb
@@ -103,12 +103,13 @@ def billed?
         end
 
         # @return [:success, :fail, :not_processed]
-        # When selfie result is missing, return :not_processed
+        # When selfie result is missing or not requested:
+        #   return :not_processed
         # Otherwise:
         #   return :success if selfie check result == 'Pass'
         #   return :fail
         def selfie_status
-          return :not_processed if selfie_result.nil?
+          return :not_processed if selfie_result.nil? || !@liveness_checking_enabled
           selfie_result == 'Pass' ? :success : :fail
         end
 
diff --git a/app/services/doc_auth/mock/result_response.rb b/app/services/doc_auth/mock/result_response.rb
index 591bada941e..6155b5f05d8 100644
--- a/app/services/doc_auth/mock/result_response.rb
+++ b/app/services/doc_auth/mock/result_response.rb
@@ -86,7 +86,7 @@ def pii_from_doc
       end
 
       def success?
-        doc_auth_success? && (selfie_check_performed? ? selfie_passed? : true)
+        doc_auth_success? && (@selfie_required ? selfie_passed? : true)
       end
 
       def attention_with_barcode?
diff --git a/app/services/document_capture_session_result.rb b/app/services/document_capture_session_result.rb
index 33ae3c94e94..4c50a0ce2d4 100644
--- a/app/services/document_capture_session_result.rb
+++ b/app/services/document_capture_session_result.rb
@@ -26,12 +26,7 @@ def selfie_status
     self[:selfie_status].to_sym
   end
 
-  def success_status
-    # doc_auth_success : including document, attention_with_barcode and id type verification
-    !!doc_auth_success && selfie_status != :fail && !!pii
-  end
-
-  alias_method :success?, :success_status
+  alias_method :success?, :success
   alias_method :attention_with_barcode?, :attention_with_barcode
   alias_method :pii_from_doc, :pii
 
diff --git a/spec/controllers/idv/hybrid_mobile/document_capture_controller_spec.rb b/spec/controllers/idv/hybrid_mobile/document_capture_controller_spec.rb
index 0ad2cc44fc0..de0d01b980d 100644
--- a/spec/controllers/idv/hybrid_mobile/document_capture_controller_spec.rb
+++ b/spec/controllers/idv/hybrid_mobile/document_capture_controller_spec.rb
@@ -268,6 +268,7 @@ def stub_document_capture_session_result
         captured_at: document_capture_session_result_captured_at,
         doc_auth_success: document_capture_session_result_success,
         selfie_status: document_capture_session_result_success ? :success : :fail,
+        success: document_capture_session_result_success,
       ),
     )
   end
diff --git a/spec/features/idv/doc_auth/document_capture_spec.rb b/spec/features/idv/doc_auth/document_capture_spec.rb
index c115d022e37..c791001e544 100644
--- a/spec/features/idv/doc_auth/document_capture_spec.rb
+++ b/spec/features/idv/doc_auth/document_capture_spec.rb
@@ -192,11 +192,18 @@
         expect_step_indicator_current_step(t('step_indicator.flows.idv.verify_id'))
         expect(page).not_to have_content(t('doc_auth.headings.document_capture_selfie'))
 
-        attach_and_submit_images
+        # doc auth is successful while liveness is not req'd
+        attach_images(
+          Rails.root.join(
+            'spec', 'fixtures',
+            'ial2_test_credential_no_liveness.yml'
+          ),
+        )
+        submit_images
 
         expect(page).to have_current_path(idv_ssn_url)
         expect_costing_for_document
-        expect(DocAuthLog.find_by(user_id: user.id).state).to eq('MT')
+        expect(DocAuthLog.find_by(user_id: user.id).state).to eq('NY')
 
         expect(page).to have_current_path(idv_ssn_url)
         fill_out_ssn_form_ok
diff --git a/spec/services/doc_auth/lexis_nexis/responses/true_id_response_spec.rb b/spec/services/doc_auth/lexis_nexis/responses/true_id_response_spec.rb
index 40479f87e60..d783ed877ad 100644
--- a/spec/services/doc_auth/lexis_nexis/responses/true_id_response_spec.rb
+++ b/spec/services/doc_auth/lexis_nexis/responses/true_id_response_spec.rb
@@ -9,6 +9,9 @@
   let(:success_with_liveness_response) do
     instance_double(Faraday::Response, status: 200, body: LexisNexisFixtures.true_id_response_success_with_liveness)
   end
+  let(:doc_auth_success_with_face_match_fail) do
+    instance_double(Faraday::Response, status: 200, body: LexisNexisFixtures.true_id_response_with_face_match_fail)
+  end
   let(:failure_response_face_match_fail) do
     instance_double(Faraday::Response, status: 200, body: LexisNexisFixtures.true_id_response_with_face_match_fail)
   end
@@ -50,7 +53,7 @@
   let(:config) do
     DocAuth::LexisNexis::Config.new
   end
-  let(:liveness_enabled) { false }
+  let(:liveness_checking_enabled) { false }
   let(:workflow) { 'default_workflow' }
   let(:request_context) do
     {
@@ -59,13 +62,53 @@
   end
   context 'when the response is a success' do
     let(:response) do
-      described_class.new(success_response, config, liveness_enabled, request_context)
+      described_class.new(success_response, config, liveness_checking_enabled, request_context)
     end
 
     it 'is a successful result' do
       expect(response.successful_result?).to eq(true)
       expect(response.to_h[:vendor]).to eq('TrueID')
     end
+
+    context 'when a portrait match is returned' do
+      let(:liveness_checking_enabled) { true }
+      context 'when selfie status is failed' do
+        let(:response) do
+          described_class.new(
+            doc_auth_success_with_face_match_fail, config,
+            liveness_checking_enabled, request_context
+          )
+        end
+        it 'is a failed result' do
+          expect(response.selfie_status).to eq(:fail)
+          expect(response.success?).to eq(false)
+          expect(response.to_h[:vendor]).to eq('TrueID')
+        end
+
+        context 'when a liveness check was not requested' do
+          let(:liveness_checking_enabled) { false }
+          it 'is a successful result' do
+            expect(response.selfie_status).to eq(:not_processed)
+            expect(response.success?).to eq(true)
+            expect(response.to_h[:vendor]).to eq('TrueID')
+          end
+        end
+      end
+      context 'when selfie status passes' do
+        let(:response) do
+          described_class.new(
+            success_with_liveness_response, config, liveness_checking_enabled,
+            request_context
+          )
+        end
+        it 'is a successful result' do
+          expect(response.selfie_status).to eq(:success)
+          expect(response.success?).to eq(true)
+          expect(response.to_h[:vendor]).to eq('TrueID')
+        end
+      end
+    end
+
     it 'has no error messages' do
       expect(response.error_messages).to be_empty
     end
@@ -325,84 +368,92 @@ def get_decision_product(resp)
       expect(errors[:back]).to contain_exactly(DocAuth::Errors::FALLBACK_FIELD_LEVEL)
       expect(errors[:hints]).to eq(true)
     end
+    context 'when liveness enabled' do
+      let(:liveness_checking_enabled) { true }
+      it 'returns Failed for visible_pattern when it gets passed and failed value ' do
+        output = described_class.new(
+          failure_response_no_liveness, config,
+          liveness_checking_enabled
+        ).to_h
+        expect(output.to_h[:log_alert_results]).
+          to match(a_hash_including(visible_pattern: { no_side: 'Failed' }))
+      end
 
-    it 'returns Failed for visible_pattern when it gets passed and failed value ' do
-      output = described_class.new(failure_response_no_liveness, config).to_h
-      expect(output.to_h[:log_alert_results]).
-        to match(a_hash_including(visible_pattern: { no_side: 'Failed' }))
-    end
-
-    it 'returns Failed for liveness failure' do
-      response = described_class.new(failure_response_with_liveness, config)
-      output = response.to_h
-      expect(output[:success]).to eq(false)
-      expect(response.doc_auth_success?).to eq(false)
-      expect(response.selfie_status).to eq(:fail)
-    end
-
-    it 'produces expected hash output' do
-      output = described_class.new(
-        failure_response_with_all_failures, config, liveness_enabled,
-        request_context
-      ).to_h
+      it 'returns Failed for liveness failure' do
+        response = described_class.new(
+          failure_response_with_liveness, config,
+          liveness_checking_enabled
+        )
+        output = response.to_h
+        expect(output[:success]).to eq(false)
+        expect(response.doc_auth_success?).to eq(false)
+        expect(response.selfie_status).to eq(:fail)
+      end
 
-      expect(output).to match(
-        success: false,
-        exception: nil,
-        errors: {
-          general: [DocAuth::Errors::GENERAL_ERROR],
-          front: [DocAuth::Errors::FALLBACK_FIELD_LEVEL],
-          back: [DocAuth::Errors::FALLBACK_FIELD_LEVEL],
-          hints: true,
-        },
-        attention_with_barcode: false,
-        doc_type_supported: true,
-        conversation_id: a_kind_of(String),
-        request_id: a_kind_of(String),
-        reference: a_kind_of(String),
-        vendor: 'TrueID',
-        billed: true,
-        log_alert_results: a_hash_including('2d_barcode_content': { no_side: 'Failed' }),
-        transaction_status: 'failed',
-        transaction_reason_code: 'failed_true_id',
-        product_status: 'pass',
-        decision_product_status: 'fail',
-        doc_auth_result: 'Failed',
-        processed_alerts: a_hash_including(:passed, :failed),
-        address_line2_present: false,
-        alert_failure_count: a_kind_of(Numeric),
-        portrait_match_results: {
-          'FaceMatchResult' => 'Fail',
-          'FaceMatchScore' => '0',
-          'FaceStatusCode' => '0',
-          'FaceErrorMessage' => 'Liveness: PoorQuality',
-        },
-        image_metrics: a_hash_including(:front, :back),
-        'ClassificationMode' => 'Automatic',
-        'DocAuthResult' => 'Failed',
-        'DocClass' => 'DriversLicense',
-        'DocClassCode' => 'DriversLicense',
-        'DocClassName' => 'Drivers License',
-        'DocumentName' => 'Connecticut (CT) Driver License',
-        'DocIssuerCode' => 'CT',
-        'DocIssuerType' => 'StateProvince',
-        'DocIssuerName' => 'Connecticut',
-        'DocIssue' => '2009',
-        'DocIssueType' => 'Driver License',
-        'DocIsGeneric' => 'false',
-        'OrientationChanged' => 'false',
-        'PresentationChanged' => 'false',
-        classification_info: {
-          Front: a_hash_including(:ClassName, :CountryCode, :IssuerType),
-          Back: a_hash_including(:ClassName, :CountryCode, :IssuerType),
-        },
-        doc_auth_success: false,
-        selfie_status: :fail,
-        selfie_live: true,
-        selfie_quality_good: false,
-        liveness_enabled: false,
-        workflow: anything,
-      )
+      it 'produces expected hash output' do
+        output = described_class.new(
+          failure_response_with_all_failures, config, liveness_checking_enabled,
+          request_context
+        ).to_h
+
+        expect(output).to match(
+          success: false,
+          exception: nil,
+          errors: {
+            general: [DocAuth::Errors::GENERAL_ERROR],
+            front: [DocAuth::Errors::FALLBACK_FIELD_LEVEL],
+            back: [DocAuth::Errors::FALLBACK_FIELD_LEVEL],
+            hints: true,
+          },
+          attention_with_barcode: false,
+          doc_type_supported: true,
+          conversation_id: a_kind_of(String),
+          request_id: a_kind_of(String),
+          reference: a_kind_of(String),
+          vendor: 'TrueID',
+          billed: true,
+          log_alert_results: a_hash_including('2d_barcode_content': { no_side: 'Failed' }),
+          transaction_status: 'failed',
+          transaction_reason_code: 'failed_true_id',
+          product_status: 'pass',
+          decision_product_status: 'fail',
+          doc_auth_result: 'Failed',
+          processed_alerts: a_hash_including(:passed, :failed),
+          address_line2_present: false,
+          alert_failure_count: a_kind_of(Numeric),
+          portrait_match_results: {
+            'FaceMatchResult' => 'Fail',
+            'FaceMatchScore' => '0',
+            'FaceStatusCode' => '0',
+            'FaceErrorMessage' => 'Liveness: PoorQuality',
+          },
+          image_metrics: a_hash_including(:front, :back),
+          'ClassificationMode' => 'Automatic',
+          'DocAuthResult' => 'Failed',
+          'DocClass' => 'DriversLicense',
+          'DocClassCode' => 'DriversLicense',
+          'DocClassName' => 'Drivers License',
+          'DocumentName' => 'Connecticut (CT) Driver License',
+          'DocIssuerCode' => 'CT',
+          'DocIssuerType' => 'StateProvince',
+          'DocIssuerName' => 'Connecticut',
+          'DocIssue' => '2009',
+          'DocIssueType' => 'Driver License',
+          'DocIsGeneric' => 'false',
+          'OrientationChanged' => 'false',
+          'PresentationChanged' => 'false',
+          classification_info: {
+            Front: a_hash_including(:ClassName, :CountryCode, :IssuerType),
+            Back: a_hash_including(:ClassName, :CountryCode, :IssuerType),
+          },
+          doc_auth_success: false,
+          selfie_status: :fail,
+          selfie_live: true,
+          selfie_quality_good: false,
+          liveness_enabled: true,
+          workflow: anything,
+        )
+      end
     end
     it 'produces appropriate errors with document tampering' do
       output = described_class.new(failure_response_tampering, config).to_h
@@ -440,7 +491,7 @@ def get_decision_product(resp)
 
     it 'produces reasonable output for a TrueID failure without details' do
       output = described_class.new(
-        failure_response_empty, config, liveness_enabled,
+        failure_response_empty, config, liveness_checking_enabled,
         request_context
       ).to_h
 
@@ -457,7 +508,7 @@ def get_decision_product(resp)
     it 'produces reasonable output for a malformed TrueID response' do
       allow(NewRelic::Agent).to receive(:notice_error)
       output = described_class.new(
-        failure_response_malformed, config, liveness_enabled,
+        failure_response_malformed, config, liveness_checking_enabled,
         request_context
       ).to_h
 
diff --git a/spec/services/document_capture_session_result_spec.rb b/spec/services/document_capture_session_result_spec.rb
index b32434f5ee7..adec9184567 100644
--- a/spec/services/document_capture_session_result_spec.rb
+++ b/spec/services/document_capture_session_result_spec.rb
@@ -53,72 +53,16 @@
     end
 
     describe '#success?' do
-      it 'reports true when doc_auth_success is true and selfie_status is :not_processed' do
-        result = DocumentCaptureSessionResult.new(
-          id: id,
-          success: false,
-          pii: pii,
-          attention_with_barcode: false,
-          selfie_status: :not_processed,
-          doc_auth_success: true,
-        )
-        expect(result.success?).to eq(true)
-      end
-      it 'reports correctly from false when missing doc_auth_success and selfie_status' do
+      it 'returns the value in the success attribute' do
         result = DocumentCaptureSessionResult.new(
           id: id,
           success: true,
-          pii: pii,
-          attention_with_barcode: false,
-        )
-        expect(result.success?).to eq(false)
-      end
-      it 'reports failure when selfie_status is :fail' do
-        result = DocumentCaptureSessionResult.new(
-          id: id,
-          success: false,
-          pii: pii,
+          pii: nil,
           attention_with_barcode: false,
           selfie_status: :fail,
-          doc_auth_success: true,
-        )
-        expect(result.success?).to eq(false)
-      end
-
-      it 'reports failure when doc_auth_success is false' do
-        result = DocumentCaptureSessionResult.new(
-          id: id,
-          success: false,
-          pii: pii,
-          attention_with_barcode: false,
-          selfie_status: :success,
           doc_auth_success: false,
         )
-        expect(result.success?).to eq(false)
-      end
-
-      describe 'when success field, doc_auth_success, and selfie_status conflict' do
-        it 'reports correct result' do
-          result = DocumentCaptureSessionResult.new(
-            id: id,
-            success: false,
-            pii: pii,
-            attention_with_barcode: false,
-            selfie_status: :not_processed,
-            doc_auth_success: true,
-          )
-          expect(result.success?).to eq(true)
-
-          result = DocumentCaptureSessionResult.new(
-            id: id,
-            success: true,
-            pii: pii,
-            attention_with_barcode: false,
-            selfie_status: :fail,
-            doc_auth_success: true,
-          )
-          expect(result.success?).to eq(false)
-        end
+        expect(result.success?).to eq(true)
       end
     end
   end