18F · amirbey · Aug 26, 2025 · Aug 22, 2025 · Aug 25, 2025 · Aug 25, 2025
diff --git a/app/controllers/concerns/idv/choose_id_type_concern.rb b/app/controllers/concerns/idv/choose_id_type_concern.rb
@@ -8,9 +8,17 @@ def chosen_id_type
 
     def set_passport_requested
       if chosen_id_type == 'passport'
-        document_capture_session.update!(passport_status: 'requested')
+        unless document_capture_session.passport_requested?
+          document_capture_session.update!(
+            passport_status: 'requested',
+            doc_auth_vendor: nil,
+          )
+        end
       else
-        document_capture_session.update!(passport_status: 'not_requested')
+        document_capture_session.update!(
+          passport_status: 'not_requested',
+          doc_auth_vendor: nil,
+        )
       end
     end
 

diff --git a/app/controllers/concerns/idv/doc_auth_vendor_concern.rb b/app/controllers/concerns/idv/doc_auth_vendor_concern.rb
@@ -4,38 +4,6 @@ module Idv
   module DocAuthVendorConcern
     include AbTestingConcern
 
-    # @returns[String] String identifying the vendor to use for doc auth.
-    def doc_auth_vendor
-      idv_session.bucketed_doc_auth_vendor ||= begin
-        bucket = nil
-        if socure_user_set.maxed_users?
-          bucket = choose_non_socure_bucket
-        elsif resolved_authn_context_result.facial_match?
-          if idv_session.passport_allowed
-            bucket = choose_non_socure_bucket
-          else
-            bucket = ab_test_bucket(:DOC_AUTH_SELFIE_VENDOR)
-          end
-        elsif idv_session.passport_allowed
-          bucket = ab_test_bucket(:DOC_AUTH_PASSPORT_VENDOR)
-        else
-          bucket = ab_test_bucket(:DOC_AUTH_VENDOR)
-        end
-
-        if bucket == :socure
-          if !add_user_to_socure_set
-            bucket = choose_non_socure_bucket # force to lexis_nexis if max user reached
-          end
-        end
-
-        DocAuthRouter.doc_auth_vendor_for_bucket(
-          bucket,
-          selfie: resolved_authn_context_result.facial_match?,
-          passport_allowed: idv_session.passport_allowed,
-        )
-      end
-    end
-
     def doc_auth_vendor_enabled?(vendor)
       return true if IdentityConfig.store.doc_auth_vendor_default == vendor
       return false unless IdentityConfig.store.doc_auth_vendor_switching_enabled
@@ -64,6 +32,12 @@ def doc_auth_selfie_vendor_enabled?(vendor)
       end
     end
 
+    def update_doc_auth_vendor(user: current_user)
+      if document_capture_session.doc_auth_vendor.blank?
+        document_capture_session.update!(doc_auth_vendor: bucketed_doc_auth_vendor(user))
+      end
+    end
+
     private
 
     def choose_non_socure_bucket
@@ -78,17 +52,44 @@ def socure_user_set
       @socure_user_set ||= SocureUserSet.new
     end
 
-    def add_user_to_socure_set
-      uuid = current_user&.uuid
-      if uuid.nil? && defined?(document_capture_user)
-        uuid = document_capture_user&.uuid
-      end
-
-      if uuid
-        return socure_user_set.add_user!(user_uuid: uuid)
+    def add_user_to_socure_set(user)
+      if user&.uuid
+        return socure_user_set.add_user!(user_uuid: user.uuid)
       end
 
       false
     end
+
+    # @returns[String] String identifying the vendor to use for doc auth.
+    def bucketed_doc_auth_vendor(user)
+      @bucketed_doc_auth_vendor ||= begin
+        bucket = nil
+        if socure_user_set.maxed_users?
+          bucket = choose_non_socure_bucket
+        elsif resolved_authn_context_result.facial_match?
+          if document_capture_session.passport_requested?
+            bucket = choose_non_socure_bucket
+          else
+            bucket = ab_test_bucket(:DOC_AUTH_SELFIE_VENDOR, user:)
+          end
+        elsif document_capture_session.passport_requested?
+          bucket = ab_test_bucket(:DOC_AUTH_PASSPORT_VENDOR, user:)
+        else
+          bucket = ab_test_bucket(:DOC_AUTH_VENDOR, user:)
+        end
+
+        if bucket == :socure
+          if !add_user_to_socure_set(user)
+            bucket = choose_non_socure_bucket # force to lexis_nexis if max user reached
+          end
+        end
+
+        DocAuthRouter.doc_auth_vendor_for_bucket(
+          bucket,
+          selfie: resolved_authn_context_result.facial_match?,
+          passport_requested: document_capture_session.passport_requested?,
+        )
+      end
+    end
   end
 end
diff --git a/app/controllers/idv/document_capture_controller.rb b/app/controllers/idv/document_capture_controller.rb
@@ -7,9 +7,11 @@ class DocumentCaptureController < ApplicationController
     include DocumentCaptureConcern
     include IdvStepConcern
     include StepIndicatorConcern
+    include DocAuthVendorConcern
 
     before_action :confirm_not_rate_limited, except: [:update, :direct_in_person]
     before_action :confirm_step_allowed, unless: -> { allow_direct_ipp? }
+    before_action :update_doc_auth_vendor, only: :show
     before_action :override_csp_to_allow_acuant
     before_action :set_usps_form_presenter
     before_action -> do

diff --git a/app/controllers/idv/hybrid_mobile/choose_id_type_controller.rb b/app/controllers/idv/hybrid_mobile/choose_id_type_controller.rb
@@ -44,10 +44,7 @@ def update
 
       def redirect_if_passport_not_available
         unless document_capture_session.passport_allowed?
-          redirect_to correct_vendor_path(
-            document_capture_session.doc_auth_vendor,
-            in_hybrid_mobile: true,
-          )
+          redirect_to idv_hybrid_mobile_document_capture_url
         end
       end
 

diff --git a/app/controllers/idv/hybrid_mobile/document_capture_controller.rb b/app/controllers/idv/hybrid_mobile/document_capture_controller.rb
@@ -6,10 +6,14 @@ class DocumentCaptureController < ApplicationController
       include Idv::AvailabilityConcern
       include DocumentCaptureConcern
       include HybridMobileConcern
+      include DocAuthVendorConcern
 
       before_action :check_valid_document_capture_session
       before_action :override_csp_to_allow_acuant
       before_action :confirm_document_capture_needed, only: :show
+      before_action -> do
+        update_doc_auth_vendor(user: document_capture_user)
+      end, only: :show
       before_action :set_usps_form_presenter
       before_action -> do
         redirect_to_correct_vendor(Idp::Constants::Vendors::LEXIS_NEXIS, in_hybrid_mobile: true)

diff --git a/app/controllers/idv/hybrid_mobile/entry_controller.rb b/app/controllers/idv/hybrid_mobile/entry_controller.rb
@@ -19,10 +19,7 @@ def show
           return
         end
 
-        redirect_to correct_vendor_path(
-          document_capture_session.doc_auth_vendor,
-          in_hybrid_mobile: true,
-        )
+        redirect_to idv_hybrid_mobile_document_capture_url
       end
 
       private

diff --git a/app/controllers/idv/hybrid_mobile/socure/document_capture_controller.rb b/app/controllers/idv/hybrid_mobile/socure/document_capture_controller.rb
@@ -9,10 +9,14 @@ class DocumentCaptureController < ApplicationController
         include Idv::HybridMobile::HybridMobileConcern
         include RenderConditionConcern
         include SocureErrorsConcern
+        include DocAuthVendorConcern
 
         check_or_render_not_found -> { IdentityConfig.store.socure_docv_enabled }
         before_action :check_valid_document_capture_session
         before_action :validate_step_not_completed, only: [:show]
+        before_action -> do
+          update_doc_auth_vendor(user: document_capture_user)
+        end, only: :show
         before_action -> do
           redirect_to_correct_vendor(Idp::Constants::Vendors::SOCURE, in_hybrid_mobile: true)
         end, only: :show

diff --git a/app/controllers/idv/socure/document_capture_controller.rb b/app/controllers/idv/socure/document_capture_controller.rb
@@ -7,6 +7,7 @@ class DocumentCaptureController < ApplicationController
       include IdvStepConcern
       include DocumentCaptureConcern
       include RenderConditionConcern
+      include DocAuthVendorConcern
 
       check_or_render_not_found -> { IdentityConfig.store.socure_docv_enabled }
 
@@ -16,6 +17,7 @@ class DocumentCaptureController < ApplicationController
       end, only: :update
 
       before_action :confirm_step_allowed
+      before_action :update_doc_auth_vendor, only: :show
       before_action -> do
         redirect_to_correct_vendor(Idp::Constants::Vendors::SOCURE, in_hybrid_mobile: false)
       end, only: :show

diff --git a/app/controllers/idv/welcome_controller.rb b/app/controllers/idv/welcome_controller.rb
@@ -5,7 +5,6 @@ class WelcomeController < ApplicationController
     include Idv::AvailabilityConcern
     include IdvStepConcern
     include StepIndicatorConcern
-    include DocAuthVendorConcern
     include Idv::ChooseIdTypeConcern
 
     before_action :confirm_step_allowed
@@ -14,7 +13,6 @@ class WelcomeController < ApplicationController
     before_action :update_passport_allowed,
                   only: :show,
                   if: -> { IdentityConfig.store.doc_auth_passports_enabled }
-    before_action :update_doc_auth_vendor
 
     def show
       idv_session.proofing_started_at ||= Time.zone.now.iso8601
@@ -47,7 +45,6 @@ def self.step_info
         undo_step: ->(idv_session:, user:) do
           idv_session.welcome_visited = nil
           idv_session.document_capture_session_uuid = nil
-          idv_session.bucketed_doc_auth_vendor = nil
           idv_session.passport_allowed = nil
         end,
       )
@@ -59,26 +56,14 @@ def analytics_arguments
       {
         step: 'welcome',
         analytics_id: 'Doc Auth',
-        doc_auth_vendor: idv_session.bucketed_doc_auth_vendor,
         passport_allowed: idv_session.passport_allowed,
       }.merge(ab_test_analytics_buckets)
     end
 
     def create_document_capture_session
-      existing_session = if idv_session.document_capture_session_uuid
-                           DocumentCaptureSession.find_by(
-                             uuid: idv_session.document_capture_session_uuid,
-                           )
-                         end
-
-      if existing_session
-        return
-      end
-
       document_capture_session = DocumentCaptureSession.create!(
         user_id: current_user.id,
         issuer: sp_session[:issuer],
-        doc_auth_vendor:,
         passport_status:,
       )
       idv_session.document_capture_session_uuid = document_capture_session.uuid
@@ -90,10 +75,6 @@ def cancel_previous_in_person_enrollments
       )
     end
 
-    def update_doc_auth_vendor
-      doc_auth_vendor
-    end
-
     def update_passport_allowed
       if !IdentityConfig.store.doc_auth_passports_enabled || (
         resolved_authn_context_result.facial_match? &&

diff --git a/app/services/analytics_events.rb b/app/services/analytics_events.rb
@@ -2392,14 +2392,12 @@ def idv_doc_auth_warning_visited(step_name:, remaining_submit_attempts:, **extra
   # User submits IdV welcome screen
   # @param [String] step Current IdV step
   # @param [String] analytics_id Current IdV flow identifier
-  # @param [String] doc_auth_vendor Vendor used for document capture
   # @param [Boolean] passport_allowed Whether passport is allowed for document capture
   # @param [Boolean] skip_hybrid_handoff Whether skipped hybrid handoff A/B test is active
   # @param [Boolean] opted_in_to_in_person_proofing User opted into in person proofing
   def idv_doc_auth_welcome_submitted(
     step:,
     analytics_id:,
-    doc_auth_vendor:,
     passport_allowed:,
     opted_in_to_in_person_proofing: nil,
     skip_hybrid_handoff: nil,
@@ -2409,7 +2407,6 @@ def idv_doc_auth_welcome_submitted(
       'IdV: doc auth welcome submitted',
       step:,
       analytics_id:,
-      doc_auth_vendor:,
       passport_allowed:,
       opted_in_to_in_person_proofing:,
       skip_hybrid_handoff:,
@@ -2420,14 +2417,12 @@ def idv_doc_auth_welcome_submitted(
   # User visits IdV welcome screen
   # @param [String] step Current IdV step
   # @param [String] analytics_id Current IdV flow identifier
-  # @param [String] doc_auth_vendor Vendor used for document capture
   # @param [Boolean] passport_allowed Whether passport is allowed for document capture
   # @param [Boolean] skip_hybrid_handoff Whether skipped hybrid handoff A/B test is active
   # @param [Boolean] opted_in_to_in_person_proofing User opted into in person proofing
   def idv_doc_auth_welcome_visited(
     step:,
     analytics_id:,
-    doc_auth_vendor:,
     passport_allowed:,
     opted_in_to_in_person_proofing: nil,
     skip_hybrid_handoff: nil,
@@ -2437,7 +2432,6 @@ def idv_doc_auth_welcome_visited(
       'IdV: doc auth welcome visited',
       step:,
       analytics_id:,
-      doc_auth_vendor:,
       passport_allowed:,
       skip_hybrid_handoff:,
       opted_in_to_in_person_proofing:,

diff --git a/app/services/doc_auth_router.rb b/app/services/doc_auth_router.rb
@@ -196,7 +196,7 @@ def self.client(vendor:, warn_notifier: nil)
   end
   # rubocop:enable Layout/LineLength
 
-  def self.doc_auth_vendor_for_bucket(bucket, selfie: false, passport_allowed: false)
+  def self.doc_auth_vendor_for_bucket(bucket, selfie: false, passport_requested: false)
     case bucket
     when :socure
       Idp::Constants::Vendors::SOCURE
@@ -209,7 +209,7 @@ def self.doc_auth_vendor_for_bucket(bucket, selfie: false, passport_allowed: fal
     else # e.g., nil
       if selfie
         IdentityConfig.store.doc_auth_selfie_vendor_default
-      elsif passport_allowed
+      elsif passport_requested
         IdentityConfig.store.doc_auth_passport_vendor_default
       else
         IdentityConfig.store.doc_auth_vendor_default