LG-12609 piv interstitial method

app/controllers/concerns/piv_cac_concern.rb

@@ -44,4 +44,4 @@ def piv_cac_setup_csp_form_action_uris
                   end
     [piv_cac_uri] + csp_uris
   end
-end
+end 

app/controllers/users/possible_piv_user_controller.rb

@@ -0,0 +1,44 @@
+module Users
+    class PossiblePivUserController < ApplicationController
+      include TwoFactorAuthenticatableMethods
+      include MfaSetupConcern
+      include SecureHeadersConcern
+      include ReauthenticationRequiredConcern
+
+      before_action :authenticate_user!
+      before_action :confirm_user_authenticated_for_2fa_setup
+      before_action :apply_secure_headers_override
+      before_action :user_email_is_gov_or_mil?
+
+      helper_method :in_multi_mfa_selection_flow?
+
+      def show
+        @email_type = email_type
+        analytics.gov_or_mil_email_detected_visited
+      end
+
+      def confirm
+        UpdateUser.new(user: current_user, attributes: { piv_cac_recommended_dismissed: true }).call
+        user_session[:mfa_selections] = ['piv_cac']
+        redirect_to confirmation_path(user_session[:mfa_selections].first)
+      end
+
+
+      private 
+
+      def user_email_is_gov_or_mil?
+        redirect_to after_sign_in_path_for(current_user) unless current_user.has_gov_or_mil_email?
+      end
+
+      def email_type
+        address = current_user.confirmed_email_addresses.select {|address| address.gov_or_mil? }
+        case address.first.email.end_with?('.gov')
+        when true
+          '.gov'
+        else
+          '.mil'
+        end
+      end
+    end
+  end
+

app/controllers/users/two_factor_authentication_setup_controller.rb

@@ -2,9 +2,11 @@ module Users
   class TwoFactorAuthenticationSetupController < ApplicationController
     include UserAuthenticator
     include MfaSetupConcern
+    include PivCacConcern
 
     before_action :authenticate_user
     before_action :confirm_user_authenticated_for_2fa_setup
+    before_action :check_if_possible_piv_user
 
     delegate :enabled_mfa_methods_count, to: :mfa_context
 
@@ -84,5 +86,11 @@ def two_factor_options_form_params
     rescue ActionController::ParameterMissing
       ActionController::Parameters.new(selection: [])
     end
+
+    def check_if_possible_piv_user
+      if current_user.has_gov_or_mil_email? && !current_user.piv_cac_recommended_dismissed
+        redirect_to login_possible_piv_user_path 
+      end
+    end
   end
 end

app/models/email_address.rb

@@ -17,6 +17,10 @@ def email=(email)
     self.email_fingerprint = email.present? ? encrypted_attributes[:email].fingerprint : ''
   end
 
+  def gov_or_mil?
+    self.email.end_with?('.gov', '.mil')
+  end
+
   def confirmed?
     confirmed_at.present?
   end

app/models/user.rb

@@ -74,6 +74,10 @@ def confirmed?
     email_addresses.where.not(confirmed_at: nil).any?
   end
 
+  def has_gov_or_mil_email?
+    confirmed_email_addresses.any?(&:gov_or_mil?)
+  end
+
   def accepted_rules_of_use_still_valid?
     if self.accepted_terms_at.present?
       self.accepted_terms_at > IdentityConfig.store.rules_of_use_updated_at &&

app/presenters/two_factor_options_presenter.rb

@@ -118,4 +118,8 @@ def mfa_policy
   def user_has_dismissed_second_mfa_reminder?
     user.second_mfa_reminder_dismissed_at.present?
   end
+
+  def user_has_gov_or_mil_email?
+    user.confirmed_email_addresses.any?(&:gov_or_mil?)
+  end
 end

app/services/analytics_events.rb

@@ -3986,6 +3986,10 @@ def personal_key_reactivation_visited
     track_event('Personal key reactivation: Personal key form visited')
   end
 
+  def gov_or_mil_email_detected_visited
+    track_event('gov_or_mil_email_detected_visited')
+  end
+
   # @param [Boolean] personal_key_present if personal key is present
   # Personal key viewed
   def personal_key_viewed(personal_key_present:, **extra)

app/views/users/possible_piv_user/show.html.erb

@@ -0,0 +1,28 @@
+<% self.title = t('titles.piv_cac_setup.upsell') %>
+
+<%= render AlertIconComponent.new(icon_name: :info_question) %>
+
+<%= render PageHeadingComponent.new.with_content(t('titles.piv_cac_setup.upsell')) %>
+
+<p>
+  <%= t('two_factor_authentication.piv_cac_upsell.info', email_type: @email_type) %>
+</p>
+
+<%= render ButtonComponent.new(
+            action: ->(**tag_options, &block) do
+              button_to(
+                login_add_piv_for_user_path,
+                **tag_options,
+                &block
+              )
+            end,
+            big: true,
+            class: 'margin-bottom-2',
+          ).with_content(t('two_factor_authentication.piv_cac_upsell.add_piv')) %>
+
+<% if MfaPolicy.new(current_user).two_factor_enabled? %>
+  <%= link_to t('links.cancel'), account_path %>
+<% else %>
+  <%= link_to t('two_factor_authentication.piv_cac_upsell.choose_other_method'), authentication_methods_setup_path %>
+<% end %>
+

config/locales/titles/en.yml

@@ -59,6 +59,7 @@ en:
       new: Use your PIV/CAC to sign in to your account
     piv_cac_setup:
       new: Use your PIV/CAC card to secure your account
+      upsell: Enhance your account security with a government employee ID
     present_piv_cac: Present your PIV/CAC
     present_webauthn: Connect your hardware security key
     reactivate_account: Reactivate your account

config/locales/two_factor_authentication/en.yml

@@ -146,6 +146,12 @@ en:
       nickname: Nickname
       renamed: Successfully renamed your PIV/CAC method
     piv_cac_header_text: Present your PIV/CAC
+    piv_cac_upsell:
+      add_piv: Add PIV/CAC card
+      choose_other_method: Choose other methods instead
+      info: Because you are using a %{email_type} email, we recommend you add your government
+        employee ID as one of your authentication methods. This adds another
+        layer of security to your account.
     please_try_again_html: Please try again in <strong>%{countdown}</strong>.
     read_about_two_factor_authentication: Read about two-factor authentication
     recaptcha:

config/routes.rb

@@ -141,6 +141,8 @@
       post 'login/add_piv_cac/prompt' => 'users/piv_cac_setup_from_sign_in#decline'
       get 'login/add_piv_cac/success' => 'users/piv_cac_setup_from_sign_in#success'
       post 'login/add_piv_cac/success' => 'users/piv_cac_setup_from_sign_in#next'
+      get 'login/possible_piv_user' => 'users/possible_piv_user#show'
+      post 'login/add_piv_for_user' => 'users/possible_piv_user#confirm'
     end
 
     if IdentityConfig.store.enable_test_routes

db/primary_migrate/20240321121322_add_pivcac_notice_on_user.rb

@@ -0,0 +1,5 @@
+class AddPivcacNoticeOnUser < ActiveRecord::Migration[7.1]
+  def change
+    add_column :users, :piv_cac_recommended_dismissed, :boolean, default: false
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2024_02_16_184124) do
+ActiveRecord::Schema[7.1].define(version: 2024_03_21_121322) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "citext"
   enable_extension "pg_stat_statements"
@@ -612,6 +612,7 @@
     t.string "encrypted_password_digest_multi_region"
     t.string "encrypted_recovery_code_digest_multi_region"
     t.datetime "second_mfa_reminder_dismissed_at"
+    t.boolean "piv_cac_recommended_dismissed", default: false
     t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
     t.index ["uuid"], name: "index_users_on_uuid", unique: true
   end
@@ -653,7 +654,7 @@
   add_foreign_key "iaa_gtcs", "partner_accounts"
   add_foreign_key "iaa_orders", "iaa_gtcs"
   add_foreign_key "in_person_enrollments", "profiles"
-  add_foreign_key "in_person_enrollments", "service_providers", column: "issuer", primary_key: "issuer"
+  add_foreign_key "in_person_enrollments", "service_providers", column: "issuer", primary_key: "issuer", validate: false
   add_foreign_key "in_person_enrollments", "users"
   add_foreign_key "integration_usages", "iaa_orders"
   add_foreign_key "integration_usages", "integrations"