LG-14552: Ensure users can't reach the IPP verify info controller without a threatmetrix session id

app/controllers/idv/in_person/address_controller.rb

@@ -7,7 +7,6 @@ class AddressController < ApplicationController
       include IdvStepConcern
 
       before_action :confirm_step_allowed
-      before_action :confirm_in_person_address_step_needed, only: :show
       before_action :set_usps_form_presenter
 
       def show
@@ -50,7 +49,9 @@ def self.step_info
           key: :ipp_address,
           controller: self,
           next_steps: [:ipp_ssn],
-          preconditions: ->(idv_session:, user:) { idv_session.ipp_state_id_complete? },
+          preconditions: ->(idv_session:, user:) {
+            idv_session.ipp_state_id_complete?
+          },
           undo_step: ->(idv_session:, user:) do
             idv_session.invalidate_in_person_address_step!
           end,
@@ -96,13 +97,6 @@ def redirect_to_next_page
         end
       end
 
-      def confirm_in_person_address_step_needed
-        return if pii_from_user&.dig(:same_address_as_id) == 'false' &&
-                  !pii_from_user.has_key?(:address1)
-        return if request.referer == idv_in_person_verify_info_url
-        redirect_to idv_in_person_ssn_url
-      end
-
       def set_usps_form_presenter
         @presenter = Idv::InPerson::UspsFormPresenter.new
       end

app/controllers/idv/in_person/ssn_controller.rb

@@ -9,9 +9,8 @@ class SsnController < ApplicationController
       include Steps::ThreatMetrixStepHelper
       include ThreatMetrixConcern
 
+      before_action :confirm_step_allowed
       before_action :confirm_not_rate_limited_after_doc_auth
-      before_action :confirm_in_person_address_step_complete
-      before_action :confirm_repeat_ssn, only: :show
       before_action :override_csp_for_threat_metrix,
                     if: -> { FeatureManagement.proofing_device_profiling_collecting_enabled? }
 
@@ -66,23 +65,17 @@ def self.step_info
           key: :ipp_ssn,
           controller: self,
           next_steps: [:ipp_verify_info],
-          preconditions: ->(idv_session:, user:) { idv_session.ipp_document_capture_complete? },
-          undo_step: ->(idv_session:, user:) { idv_session.ssn = nil },
+          preconditions: ->(idv_session:, user:) {
+            idv_session.ipp_document_capture_complete?
+          },
+          undo_step: ->(idv_session:, user:) {
+            idv_session.invalidate_ssn_step!
+          },
         )
       end
 
       private
 
-      def flow_session
-        user_session.fetch('idv/in_person', {})
-      end
-
-      def confirm_repeat_ssn
-        return if !idv_session.ssn
-        return if request.referer == idv_in_person_verify_info_url
-        redirect_to idv_in_person_verify_info_url
-      end
-
       def next_url
         idv_in_person_verify_info_url
       end
@@ -96,11 +89,6 @@ def analytics_arguments
         }.merge(ab_test_analytics_buckets)
           .merge(**extra_analytics_properties)
       end
-
-      def confirm_in_person_address_step_complete
-        return if flow_session[:pii_from_user] && flow_session[:pii_from_user][:address1].present?
-        redirect_to idv_in_person_address_url
-      end
     end
   end
 end

app/controllers/idv/in_person/verify_info_controller.rb

@@ -10,8 +10,7 @@ class VerifyInfoController < ApplicationController
       include VerifyInfoConcern
 
       before_action :confirm_not_rate_limited_after_doc_auth, except: [:show]
-      before_action :confirm_pii_data_present
-      before_action :confirm_ssn_step_complete
+      before_action :confirm_step_allowed
 
       def show
         @step_indicator_steps = step_indicator_steps
@@ -40,7 +39,8 @@ def self.step_info
           controller: self,
           next_steps: [:phone],
           preconditions: ->(idv_session:, user:) do
-            idv_session.ssn && idv_session.ipp_document_capture_complete?
+            idv_session.ssn && idv_session.ipp_document_capture_complete? &&
+              threatmetrix_session_id_present_or_not_required?(idv_session:)
           end,
           undo_step: ->(idv_session:, user:) do
             idv_session.residential_resolution_vendor = nil
@@ -89,17 +89,6 @@ def analytics_arguments
         }.merge(ab_test_analytics_buckets)
           .merge(**extra_analytics_properties)
       end
-
-      def confirm_ssn_step_complete
-        return if pii.present? && idv_session.ssn.present?
-        redirect_to prev_url
-      end
-
-      def confirm_pii_data_present
-        unless user_session.dig('idv/in_person').present?
-          redirect_to idv_path
-        end
-      end
     end
   end
 end

app/controllers/idv/ssn_controller.rb

@@ -65,7 +65,9 @@ def self.step_info
         controller: self,
         next_steps: [:verify_info],
         preconditions: ->(idv_session:, user:) { idv_session.remote_document_capture_complete? },
-        undo_step: ->(idv_session:, user:) { idv_session.ssn = nil },
+        undo_step: ->(idv_session:, user:) {
+          idv_session.invalidate_ssn_step!
+        },
       )
     end
 

app/services/idv/session.rb

@@ -302,6 +302,12 @@ def ssn_step_complete?
       ssn.present?
     end
 
+    def invalidate_ssn_step!
+      if user_session[:idv].has_key?(:ssn)
+        user_session[:idv].delete(:ssn)
+      end
+    end
+
     def verify_info_step_complete?
       resolution_successful
     end

spec/controllers/idv/in_person/address_controller_spec.rb

@@ -14,12 +14,11 @@
     allow(IdentityConfig.store).to receive(:usps_ipp_transliteration_enabled)
       .and_return(true)
     stub_sign_in(user)
-    stub_up_to(:hybrid_handoff, idv_session: subject.idv_session)
+    stub_up_to(:ipp_state_id, idv_session: subject.idv_session)
     allow(user).to receive(:establishing_in_person_enrollment).and_return(enrollment)
     subject.user_session['idv/in_person'] = {
       pii_from_user: pii_from_user,
     }
-    subject.idv_session.ssn = nil
     stub_analytics
   end
 
@@ -97,17 +96,6 @@
       expect(response).to render_template :show
     end
 
-    context 'when address1 present' do
-      before do
-        subject.user_session['idv/in_person'][:pii_from_user][:address1] = '123 Main St'
-      end
-      it 'redirects to ssn page' do
-        get :show
-
-        expect(response).to redirect_to idv_in_person_ssn_url
-      end
-    end
-
     it 'logs idv_in_person_proofing_address_visited' do
       get :show
 
@@ -170,6 +158,12 @@
         )
       end
 
+      it 'enables the user to navigate to the ssn page after entering their residential address' do
+        put :update, params: params
+
+        expect(response).to redirect_to(idv_in_person_ssn_url)
+      end
+
       it 'logs idv_in_person_proofing_address_submitted with 5-digit zipcode' do
         put :update, params: params
 
@@ -178,6 +172,7 @@
 
       context 'when updating the residential address' do
         before do
+          stub_up_to(:ipp_verify_info, idv_session: subject.idv_session)
           subject.user_session['idv/in_person'][:pii_from_user][:address1] =
             '123 New Residential Ave'
         end

spec/controllers/idv/in_person/ssn_controller_spec.rb

@@ -1,6 +1,8 @@
 require 'rails_helper'
 
 RSpec.describe Idv::InPerson::SsnController do
+  include FlowPolicyHelper
+
   let(:pii_from_user) { Idp::Constants::MOCK_IDV_APPLICANT_SAME_ADDRESS_AS_ID_WITH_NO_SSN.dup }
 
   let(:flow_session) do
@@ -25,13 +27,22 @@
   end
 
   describe 'before_actions' do
-    context '#confirm_in_person_address_step_complete' do
-      it 'redirects if address page not completed' do
-        subject.user_session['idv/in_person'][:pii_from_user].delete(:address1)
-        get :show
+    before do
+      stub_up_to(:ipp_state_id, idv_session: subject.idv_session)
+      subject.user_session['idv/in_person'][:pii_from_user].delete(:address1)
+      allow(user).to receive(:has_establishing_in_person_enrollment?).and_return(true)
+    end
+    it 'redirects if address page not completed' do
+      get :show
 
-        expect(response).to redirect_to idv_in_person_address_url
-      end
+      expect(response).to redirect_to idv_in_person_address_url
+    end
+
+    it 'checks that step is allowed' do
+      expect(subject).to have_actions(
+        :before,
+        :confirm_step_allowed,
+      )
     end
   end
 
@@ -67,37 +78,24 @@
       )
     end
 
-    it 'adds a threatmetrix session id to idv_session' do
-      expect { get :show }.to change { controller.idv_session.threatmetrix_session_id }.from(nil)
-    end
-
-    it 'does not change threatmetrix_session_id when updating ssn' do
-      controller.idv_session.ssn = ssn
-      expect { get :show }.not_to change { controller.idv_session.threatmetrix_session_id }
-    end
+    context 'threatmetrix_session_id is nil' do
+      it 'adds a threatmetrix session id to idv_session' do
+        expect { get :show }.to change { controller.idv_session.threatmetrix_session_id }.from(nil)
+      end
 
-    context 'with an ssn in idv_session' do
-      let(:referer) { idv_in_person_address_url }
-      before do
+      it 'sets a threatmetrix_session_id when updating ssn' do
         controller.idv_session.ssn = ssn
-        request.env['HTTP_REFERER'] = referer
+        expect { get :show }.to change { controller.idv_session.threatmetrix_session_id }.from(nil)
       end
+    end
 
-      context 'referer is not verify_info' do
-        it 'redirects to verify_info' do
-          get :show
-
-          expect(response).to redirect_to(idv_in_person_verify_info_url)
-        end
+    context 'threatmetrix_session_id is not nil' do
+      before do
+        stub_up_to(:ipp_ssn, idv_session: controller.idv_session)
       end
-
-      context 'referer is verify_info' do
-        let(:referer) { idv_in_person_verify_info_url }
-        it 'does not redirect' do
-          get :show
-
-          expect(response).to render_template 'idv/shared/ssn'
-        end
+      it 'does not change threatmetrix_session_id when updating ssn' do
+        controller.idv_session.ssn = ssn
+        expect { get :show }.not_to change { controller.idv_session.threatmetrix_session_id }
       end
     end