LG-14813 default users requiring facial match to LN

app/controllers/concerns/idv/doc_auth_vendor_concern.rb

@@ -6,8 +6,23 @@ module DocAuthVendorConcern
 
     # @returns[String] String identifying the vendor to use for doc auth.
     def doc_auth_vendor
-      bucket = ab_test_bucket(:DOC_AUTH_VENDOR)
+      if resolved_authn_context_result.facial_match?
+        return nil if lexis_nexis_not_enabled?
+        bucket = default_vendor_is_not_mock? ? :lexis_nexis : :mock
+      else
+        bucket = ab_test_bucket(:DOC_AUTH_VENDOR)
+      end
       DocAuthRouter.doc_auth_vendor_for_bucket(bucket)
     end
+
+    def lexis_nexis_not_enabled?
+      (IdentityConfig.store.doc_auth_vendor_default == Idp::Constants::Vendors::SOCURE ||
+        IdentityConfig.store.doc_auth_vendor_default.nil?) &&
+        IdentityConfig.store.doc_auth_vendor_lexis_nexis_percent == 0
+    end
+
+    def default_vendor_is_not_mock?
+      IdentityConfig.store.doc_auth_vendor_default != Idp::Constants::Vendors::MOCK
+    end
   end
 end

app/services/doc_auth_router.rb

@@ -201,6 +201,8 @@ def self.doc_auth_vendor_for_bucket(bucket)
       Idp::Constants::Vendors::SOCURE
     when :lexis_nexis
       Idp::Constants::Vendors::LEXIS_NEXIS
+    when :mock
+      Idp::Constants::Vendors::MOCK
     else # e.g., nil
       IdentityConfig.store.doc_auth_vendor_default
     end

spec/controllers/idv/document_capture_controller_spec.rb

@@ -142,6 +142,23 @@
       end
     end
 
+    context 'socure is the default vendor but facial match is required' do
+      let(:idv_vendor) { Idp::Constants::Vendors::SOCURE }
+      let(:vot) { 'Pb' }
+
+      before do
+        resolved_authn_context = Vot::Parser.new(vector_of_trust: vot).parse
+        allow(controller).to receive(:resolved_authn_context_result).
+          and_return(resolved_authn_context)
+      end
+
+      it 'does not redirect to Socure controller' do
+        get :show
+
+        expect(response).to_not redirect_to idv_socure_document_capture_url
+      end
+    end
+
     it 'renders the show template' do
       expect(subject).to receive(:render).with(
         :show,

spec/controllers/idv/hybrid_mobile/entry_controller_spec.rb

@@ -56,9 +56,26 @@
         {}
       end
       let(:idv_vendor) { Idp::Constants::Vendors::MOCK }
+      let(:lexis_nexis_percent) { 100 }
+      let(:acr_values) do
+        [
+          Saml::Idp::Constants::IAL2_AUTHN_CONTEXT_CLASSREF,
+          Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF,
+        ].join(' ')
+      end
 
       before do
+        resolved_authn_context = AuthnContextResolver.new(
+          user: user,
+          service_provider: nil,
+          vtr: nil,
+          acr_values: acr_values,
+        ).result
         allow(controller).to receive(:session).and_return(session)
+        allow(controller).to receive(:resolved_authn_context_result).
+          and_return(resolved_authn_context)
+        allow(IdentityConfig.store).to receive(:doc_auth_vendor_lexis_nexis_percent).
+          and_return(lexis_nexis_percent)
         get :show, params: { 'document-capture-session': session_uuid }
       end
 
@@ -70,6 +87,45 @@
         end
       end
 
+      context 'facial match is required' do
+        let(:acr_values) do
+          [
+            Saml::Idp::Constants::IAL2_BIO_REQUIRED_AUTHN_CONTEXT_CLASSREF,
+            Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF,
+          ].join(' ')
+        end
+
+        context 'doc auth vendor is socure with facial match required' do
+          let(:idv_vendor) { Idp::Constants::Vendors::SOCURE }
+
+          it 'redirects to the lexis nexis first step' do
+            expect(response).to redirect_to idv_hybrid_mobile_document_capture_url
+          end
+        end
+
+        context 'doc auth vendor is mock with facial match required' do
+          let(:idv_vendor) { Idp::Constants::Vendors::MOCK }
+
+          it 'redirects to the lexis nexis first step' do
+            expect(response).to redirect_to idv_hybrid_mobile_document_capture_url
+          end
+        end
+
+        context 'lexis nexis is disabled' do
+          let(:idv_vendor) { nil }
+          let(:lexis_nexis_percent) { 0 }
+
+          before do
+            allow(IdentityConfig.store).to receive(:doc_auth_vendor_lexis_nexis_percent).
+              and_return(lexis_nexis_percent)
+          end
+
+          it 'causes an 404 error' do
+            expect(response.status).to eq(404)
+          end
+        end
+      end
+
       context 'doc auth vendor is lexis nexis' do
         let(:idv_vendor) { Idp::Constants::Vendors::LEXIS_NEXIS }
 
@@ -78,6 +134,14 @@
         end
       end
 
+      context 'doc auth vendor is mock' do
+        let(:idv_vendor) { Idp::Constants::Vendors::MOCK }
+
+        it 'redirects to the first step' do
+          expect(response).to redirect_to idv_hybrid_mobile_document_capture_url
+        end
+      end
+
       context 'but we already had a session' do
         let!(:different_document_capture_session) do
           DocumentCaptureSession.create!(

spec/controllers/idv/hybrid_mobile/socure/document_capture_controller_spec.rb

@@ -64,11 +64,37 @@
     end
 
     context 'when we try to use this controller but we should be using the LN/mock version' do
-      let(:idv_vendor) { Idp::Constants::Vendors::LEXIS_NEXIS }
+      context 'when doc_auth_vendor is Lexis Nexis' do
+        let(:idv_vendor) { Idp::Constants::Vendors::LEXIS_NEXIS }
 
-      it 'redirects to the LN/mock controller' do
-        get :show
-        expect(response).to redirect_to idv_hybrid_mobile_document_capture_url
+        it 'redirects to the LN/mock controller' do
+          get :show
+          expect(response).to redirect_to idv_hybrid_mobile_document_capture_url
+        end
+      end
+
+      context 'when facial match is required' do
+        let(:acr_values) do
+          [
+            Saml::Idp::Constants::IAL2_BIO_REQUIRED_AUTHN_CONTEXT_CLASSREF,
+            Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF,
+          ].join(' ')
+        end
+        before do
+          resolved_authn_context = AuthnContextResolver.new(
+            user: user,
+            service_provider: nil,
+            vtr: nil,
+            acr_values: acr_values,
+          ).result
+          allow(controller).to receive(:resolved_authn_context_result).
+            and_return(resolved_authn_context)
+        end
+
+        it 'redirects to the LN/mock controller' do
+          get :show
+          expect(response).to redirect_to idv_hybrid_mobile_document_capture_url
+        end
       end
     end
 

spec/controllers/idv/socure/document_capture_controller_spec.rb

@@ -79,11 +79,37 @@
     end
 
     context 'when we try to use this controller but we should be using the LN/mock version' do
-      let(:idv_vendor) { Idp::Constants::Vendors::LEXIS_NEXIS }
+      context 'when doc_auth_vendor is Lexis Nexis' do
+        let(:idv_vendor) { Idp::Constants::Vendors::LEXIS_NEXIS }
 
-      it 'redirects to the LN/mock controller' do
-        get :show
-        expect(response).to redirect_to idv_document_capture_url
+        it 'redirects to the LN/mock controller' do
+          get :show
+          expect(response).to redirect_to idv_document_capture_url
+        end
+      end
+
+      context 'when facial match is required' do
+        let(:acr_values) do
+          [
+            Saml::Idp::Constants::IAL2_BIO_REQUIRED_AUTHN_CONTEXT_CLASSREF,
+            Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF,
+          ].join(' ')
+        end
+        before do
+          resolved_authn_context = AuthnContextResolver.new(
+            user: user,
+            service_provider: nil,
+            vtr: nil,
+            acr_values: acr_values,
+          ).result
+          allow(controller).to receive(:resolved_authn_context_result).
+            and_return(resolved_authn_context)
+        end
+
+        it 'redirects to the LN/mock controller' do
+          get :show
+          expect(response).to redirect_to idv_document_capture_url
+        end
       end
     end