Deploy RC 365 to Production

Gemfile.lock

@@ -462,7 +462,7 @@ GEM
     pg (1.5.4)
     pg_query (4.2.3)
       google-protobuf (>= 3.22.3)
-    phonelib (0.8.7)
+    phonelib (0.8.8)
     pkcs11 (0.3.4)
     premailer (1.21.0)
       addressable

app/controllers/frontend_log_controller.rb

@@ -33,6 +33,7 @@ class FrontendLogController < ApplicationController
     'IdV: personal key acknowledgment toggled' => :idv_personal_key_acknowledgment_toggled,
     'IdV: prepare submitted' => :idv_in_person_prepare_submitted,
     'IdV: prepare visited' => :idv_in_person_prepare_visited,
+    'IdV: selfie image clicked' => :idv_selfie_image_clicked,
     'IdV: switch_back submitted' => :idv_in_person_switch_back_submitted,
     'IdV: switch_back visited' => :idv_in_person_switch_back_visited,
     'IdV: user clicked sp link on ready to verify page' => :idv_in_person_ready_to_verify_sp_link_clicked,

app/controllers/idv/document_capture_controller.rb

@@ -63,6 +63,7 @@ def self.step_info
                          idv_session.flow_path == 'standard' && (
                            # mobile
                            idv_session.skip_hybrid_handoff ||
+                            idv_session.skip_doc_auth ||
                             !idv_session.selfie_check_required || # desktop but selfie not required
                              idv_session.desktop_selfie_test_mode_enabled?
                          )

app/controllers/idv/hybrid_handoff_controller.rb

@@ -13,6 +13,8 @@ def show
       @upload_disabled = idv_session.selfie_check_required &&
                          !idv_session.desktop_selfie_test_mode_enabled?
 
+      @selfie_required = idv_session.selfie_check_required
+
       analytics.idv_doc_auth_hybrid_handoff_visited(**analytics_arguments)
 
       Funnel::DocAuth::RegisterStep.new(current_user.id, sp_session[:issuer]).call(

app/controllers/openid_connect/authorization_controller.rb

@@ -28,7 +28,7 @@ class AuthorizationController < ApplicationController
     def index
       if @authorize_form.ial2_or_greater?
         return redirect_to reactivate_account_url if user_needs_to_reactivate_account?
-        return redirect_to url_for_pending_profile_reason if user_has_pending_profile?
+        return redirect_to url_for_pending_profile_reason if user_has_usable_pending_profile?
         return redirect_to idv_url if identity_needs_verification?
         return redirect_to idv_url if selfie_needed?
       end
@@ -47,6 +47,18 @@ def index
 
     private
 
+    def pending_profile_policy
+      @pending_profile_policy ||= PendingProfilePolicy.new(
+        user: current_user,
+        resolved_authn_context_result: resolved_authn_context_result,
+        biometric_comparison_requested: biometric_comparison_requested?,
+      )
+    end
+
+    def user_has_usable_pending_profile?
+      pending_profile_policy.user_has_usable_pending_profile?
+    end
+
     def block_biometric_requests_in_production
       if biometric_comparison_requested? &&
          !FeatureManagement.idv_allow_selfie_check?

app/controllers/users/piv_cac_controller.rb

@@ -1,6 +1,7 @@
 module Users
   class PivCacController < ApplicationController
     include ReauthenticationRequiredConcern
+    include PivCacConcern
 
     before_action :confirm_two_factor_authenticated
     before_action :confirm_recently_authenticated_2fa
@@ -33,6 +34,7 @@ def destroy
         create_user_event(:piv_cac_disabled)
         revoke_remember_device(current_user)
         deliver_push_notification
+        clear_piv_cac_information
 
         flash[:success] = presenter.delete_success_alert_text
         redirect_to account_path

app/javascript/packages/document-capture/components/acuant-capture.scss

@@ -37,12 +37,4 @@
   .document-capture-file-image--loading {
     @extend %pad-common-id-card;
   }
-  // Styles for the text that appears over the selfie capture screen to help users position their face for a good photo
-  .document-capture-selfie-feedback {
-    left: 50%;
-    top: 10%;
-    position: fixed;
-    transform: translateX(-50%);
-    z-index: 11;
-  }
 }

app/javascript/packages/document-capture/components/acuant-capture.tsx

@@ -698,12 +698,16 @@ function AcuantCapture(
           onImageCaptureClose={onSelfieCaptureClosed}
           onImageCaptureFeedback={onImageCaptureFeedback}
         >
-          <AcuantSelfieCaptureCanvas
-            fullScreenRef={fullScreenRef}
-            fullScreenLabel={t('doc_auth.accessible_labels.document_capture_dialog')}
-            onRequestClose={() => setIsCapturingEnvironment(false)}
-            imageCaptureText={imageCaptureText}
-          />
+          <FullScreen
+            ref={fullScreenRef}
+            label={t('doc_auth.accessible_labels.document_capture_dialog')}
+            hideCloseButton
+          >
+            <AcuantSelfieCaptureCanvas
+              imageCaptureText={imageCaptureText}
+              onSelfieCaptureClosed={onSelfieCaptureClosed}
+            />
+          </FullScreen>
         </AcuantSelfieCamera>
       )}
       <FileInput

app/javascript/packages/document-capture/components/acuant-selfie-capture-canvas.jsx

@@ -1,44 +1,37 @@
 import { useContext } from 'react';
 import { getAssetPath } from '@18f/identity-assets';
-import { FullScreen } from '@18f/identity-components';
+import { useI18n } from '@18f/identity-react-i18n';
 import AcuantContext from '../context/acuant';
 
-function FullScreenLoadingSpinner({ fullScreenRef, onRequestClose, fullScreenLabel }) {
+function LoadingSpinner() {
   return (
-    <FullScreen ref={fullScreenRef} label={fullScreenLabel} onRequestClose={onRequestClose}>
-      <img
-        src={getAssetPath('loading-badge.gif')}
-        alt=""
-        width="144"
-        height="144"
-        className="acuant-capture-canvas__spinner"
-      />
-    </FullScreen>
+    <img
+      src={getAssetPath('loading-badge.gif')}
+      alt=""
+      width="144"
+      height="144"
+      className="acuant-capture-canvas__spinner"
+    />
   );
 }
 
-function AcuantSelfieCaptureCanvas({
-  fullScreenRef,
-  onRequestClose,
-  fullScreenLabel,
-  imageCaptureText,
-}) {
+function AcuantSelfieCaptureCanvas({ imageCaptureText, onSelfieCaptureClosed }) {
   const { isReady } = useContext(AcuantContext);
+  const { t } = useI18n();
   // The Acuant SDK script AcuantPassiveLiveness attaches to whatever element has
   // this id. It then uses that element as the root for the full screen selfie capture
   const acuantCaptureContainerId = 'acuant-face-capture-container';
-  return isReady ? (
-    <div id={acuantCaptureContainerId}>
+  return (
+    <>
+      {!isReady && <LoadingSpinner />}
+      <div id={acuantCaptureContainerId} />
       <p aria-live="assertive" className="document-capture-selfie-feedback">
         {imageCaptureText}
       </p>
-    </div>
-  ) : (
-    <FullScreenLoadingSpinner
-      fullScreenRef={fullScreenRef}
-      onRequestClose={onRequestClose}
-      fullScreenLabel={fullScreenLabel}
-    />
+      <button type="button" onClick={onSelfieCaptureClosed} className="usa-sr-only">
+        {t('doc_auth.buttons.close')}
+      </button>
+    </>
   );
 }
 

app/javascript/packages/document-capture/components/acuant-selfie-capture-canvas.scss

@@ -0,0 +1,9 @@
+.document-capture-selfie-feedback {
+  color: color('white');
+  background: color('black');
+  left: 50%;
+  top: 10%;
+  position: fixed;
+  transform: translateX(-50%);
+  z-index: 11;
+}

app/javascript/packages/document-capture/components/document-side-acuant-capture.tsx

@@ -7,6 +7,7 @@ import type {
   RegisterFieldCallback,
 } from '@18f/identity-form-steps';
 import AcuantCapture from './acuant-capture';
+import SelfieCaptureContext from '../context/selfie-capture';
 
 interface DocumentSideAcuantCaptureProps {
   side: 'front' | 'back' | 'selfie';
@@ -43,6 +44,9 @@ function DocumentSideAcuantCapture({
 }: DocumentSideAcuantCaptureProps) {
   const error = errors.find(({ field }) => field === side)?.error;
   const { changeStepCanComplete } = useContext(FormStepsContext);
+  const { isSelfieCaptureEnabled, isSelfieDesktopTestMode } = useContext(SelfieCaptureContext);
+  const isUploadAllowed = isSelfieDesktopTestMode || !isSelfieCaptureEnabled;
+
   return (
     <AcuantCapture
       ref={registerField(side, { isRequired: true })}
@@ -74,6 +78,7 @@ function DocumentSideAcuantCapture({
       errorMessage={error ? error.message : undefined}
       name={side}
       className={className}
+      allowUpload={isUploadAllowed}
     />
   );
 }

app/javascript/packages/document-capture/context/acuant.tsx

@@ -8,7 +8,6 @@ import SelfieCaptureContext from './selfie-capture';
 /**
  * Global declarations
  */
-declare let AcuantJavascriptWebSdk: AcuantJavascriptWebSdkInterface; // As of 11.7.0, this is now a global object that is not on the window object.
 declare let AcuantCamera: AcuantCameraInterface;
 
 declare global {
@@ -182,11 +181,11 @@ const getActualAcuantJavascriptWebSdk = (): AcuantJavascriptWebSdkInterface => {
   if (window.AcuantJavascriptWebSdk && typeof window.AcuantJavascriptWebSdk.start === 'function') {
     return window.AcuantJavascriptWebSdk;
   }
-  if (typeof AcuantJavascriptWebSdk === 'undefined') {
+  if (!window.AcuantJavascriptWebSdk) {
     // eslint-disable-next-line no-console
     console.error('AcuantJavascriptWebSdk is not defined in the global scope');
   }
-  return AcuantJavascriptWebSdk;
+  return window.AcuantJavascriptWebSdk;
 };
 
 /**

app/javascript/packages/document-capture/context/failed-capture-attempts.tsx

@@ -1,6 +1,7 @@
-import { createContext, useState } from 'react';
+import { createContext, useContext, useState } from 'react';
 import type { ReactNode } from 'react';
 import useCounter from '../hooks/use-counter';
+import SelfieCaptureContext from './selfie-capture';
 
 interface CaptureAttemptMetadata {
   isAssessedAsGlare: boolean;
@@ -125,6 +126,7 @@ function FailedCaptureAttemptsContextProvider({
     useCounter();
   const [failedSubmissionAttempts, incrementFailedSubmissionAttempts] = useCounter();
   const [failedCameraPermissionAttempts, incrementFailedCameraPermissionAttempts] = useCounter();
+  const { isSelfieCaptureEnabled } = useContext(SelfieCaptureContext);
 
   const [failedSubmissionImageFingerprints, setFailedSubmissionImageFingerprints] =
     useState<UploadedImageFingerprints>(failedFingerprints);
@@ -143,10 +145,12 @@ function FailedCaptureAttemptsContextProvider({
     incrementFailedCameraPermissionAttempts();
   }
 
-  const forceNativeCamera =
+  const hasExhaustedAttempts =
     failedCaptureAttempts >= maxCaptureAttemptsBeforeNativeCamera ||
     failedSubmissionAttempts >= maxSubmissionAttemptsBeforeNativeCamera;
 
+  const forceNativeCamera = isSelfieCaptureEnabled ? false : hasExhaustedAttempts;
+
   return (
     <FailedCaptureAttemptsContext.Provider
       value={{

app/javascript/packages/document-capture/context/selfie-capture.tsx

@@ -5,10 +5,15 @@ interface SelfieCaptureProps {
    * Specify whether to show the selfie capture on the doc capture screen.
    */
   isSelfieCaptureEnabled: boolean;
+  /**
+   * Specify whether to allow uploads for selfie when in test mode.
+   */
+  isSelfieDesktopTestMode: boolean;
 }
 
 const SelfieCaptureContext = createContext<SelfieCaptureProps>({
   isSelfieCaptureEnabled: false,
+  isSelfieDesktopTestMode: false,
 });
 
 SelfieCaptureContext.displayName = 'SelfieCaptureContext';

app/javascript/packages/document-capture/styles.scss

@@ -1,5 +1,6 @@
 @forward './components/acuant-capture';
 @forward './components/acuant-capture-canvas';
+@forward './components/acuant-selfie-capture-canvas';
 @forward './components/file-input';
 @forward './components/location-collection-item';
 @forward './components/optional-questions';

app/javascript/packs/document-capture.tsx

@@ -39,6 +39,7 @@ interface AppRootData {
   skipDocAuth: string;
   howToVerifyURL: string;
   uiExitQuestionSectionEnabled: string;
+  docAuthSelfieDesktopTestMode: string;
 }
 
 const appRoot = document.getElementById('document-capture-form')!;
@@ -106,6 +107,7 @@ const {
   skipDocAuth,
   howToVerifyUrl,
   uiExitQuestionSectionEnabled = '',
+  docAuthSelfieDesktopTestMode,
 } = appRoot.dataset as DOMStringMap & AppRootData;
 
 let parsedUsStatesTerritories = [];
@@ -177,6 +179,15 @@ const App = composeComponents(
       value: getServiceProvider(),
     },
   ],
+  [
+    SelfieCaptureContext.Provider,
+    {
+      value: {
+        isSelfieCaptureEnabled: getSelfieCaptureEnabled(),
+        isSelfieDesktopTestMode: String(docAuthSelfieDesktopTestMode) === 'true',
+      },
+    },
+  ],
   [
     FailedCaptureAttemptsContextProvider,
     {
@@ -192,14 +203,6 @@ const App = composeComponents(
       },
     },
   ],
-  [
-    SelfieCaptureContext.Provider,
-    {
-      value: {
-        isSelfieCaptureEnabled: getSelfieCaptureEnabled(),
-      },
-    },
-  ],
   [
     DocumentCapture,
     {

app/models/profile.rb

@@ -207,6 +207,7 @@ def deactivate_for_fraud_review
       active: false,
       fraud_review_pending_at: Time.zone.now,
       fraud_rejection_at: nil,
+      in_person_verification_pending_at: nil,
     )
   end
 

app/policies/pending_profile_policy.rb

@@ -0,0 +1,40 @@
+class PendingProfilePolicy
+  def initialize(user:, resolved_authn_context_result:, biometric_comparison_requested:)
+    @user = user
+    @resolved_authn_context_result = resolved_authn_context_result
+    @biometric_comparison_requested = biometric_comparison_requested
+  end
+
+  def user_has_usable_pending_profile?
+    if biometric_comparison_requested?
+      pending_biometric_profile?
+    else
+      pending_legacy_profile? || fraud_review_pending?
+    end
+  end
+
+  private
+
+  attr_reader :user, :resolved_authn_context_result, :biometric_comparison_requested
+
+  def active_biometric_profile?
+    user.active_profile&.idv_level == 'unsupervised_with_selfie'
+  end
+
+  def pending_biometric_profile?
+    user.pending_profile&.idv_level == 'unsupervised_with_selfie'
+  end
+
+  def biometric_comparison_requested?
+    return false if !FeatureManagement.idv_allow_selfie_check?
+    resolved_authn_context_result.biometric_comparison? || biometric_comparison_requested
+  end
+
+  def pending_legacy_profile?
+    user.pending_profile.present? && user.pending_profile&.idv_level != 'unsupervised_with_selfie'
+  end
+
+  def fraud_review_pending?
+    user.fraud_review_pending?
+  end
+end