Don't allow any /verify/* path in prod without SP context (LG-3942)

app/controllers/concerns/idv_session.rb

@@ -1,6 +1,17 @@
 module IdvSession
   extend ActiveSupport::Concern
 
+  included do
+    before_action :sp_context_needed?
+  end
+
+  def sp_context_needed?
+    return if sp_from_sp_session.present?
+    return if LoginGov::Hostdata.env != 'prod'
+
+    redirect_to account_url
+  end
+
   def confirm_idv_session_started
     redirect_to idv_doc_auth_url if idv_session.applicant.blank?
   end
@@ -40,11 +51,4 @@ def idv_session
   def idv_attempter_throttled?
     Throttler::IsThrottled.call(current_user.id, :idv_resolution)
   end
-
-  def sp_context_needed?
-    return if sp_from_sp_session.present?
-    return if LoginGov::Hostdata.env != 'prod'
-
-    redirect_to account_url
-  end
 end

app/controllers/idv_controller.rb

@@ -5,7 +5,6 @@ class IdvController < ApplicationController
   before_action :confirm_two_factor_authenticated
   before_action :confirm_idv_needed, only: [:fail]
   before_action :profile_needs_reactivation?, only: [:index]
-  before_action :sp_context_needed?, only: [:index]
 
   def index
     if decorated_session.requested_more_recent_verification?

spec/controllers/idv/cac_controller_spec.rb

@@ -28,6 +28,12 @@
     stub_sign_in(user)
   end
 
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:sp_context_needed?)
+    end
+  end
+
   describe '#update' do
     it 'sets the uuid in session for the enter info step' do
       controller.user_session['idv/cac'] = flow_session

spec/controllers/idv/cancellations_controller_spec.rb

@@ -1,6 +1,12 @@
 require 'rails_helper'
 
 describe Idv::CancellationsController do
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   describe '#new' do
     it 'tracks the event in analytics when referer is nil' do
       stub_sign_in

spec/controllers/idv/confirmations_controller_spec.rb

@@ -48,6 +48,10 @@ def stub_idv_session
       )
     end
 
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+
     describe '#confirm_profile_has_been_created' do
       before do
         stub_idv_session

spec/controllers/idv/doc_auth_controller_spec.rb

@@ -10,6 +10,10 @@
                                       :fsm_initialize,
                                       :ensure_correct_step)
     end
+
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
   end
 
   before do |example|

spec/controllers/idv/forgot_password_controller_spec.rb

@@ -1,6 +1,12 @@
 require 'rails_helper'
 
 describe Idv::ForgotPasswordController do
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   describe '#new' do
     it 'tracks the event in analytics when referer is nil' do
       stub_sign_in

spec/controllers/idv/otp_delivery_method_controller_spec.rb

@@ -15,6 +15,12 @@
     subject.idv_session.user_phone_confirmation_session = user_phone_confirmation_session
   end
 
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   describe '#new' do
     context 'user has not selected phone verification method' do
       before do

spec/controllers/idv/otp_verification_controller_spec.rb

@@ -29,6 +29,12 @@
     subject.idv_session.user_phone_confirmation_session = user_phone_confirmation_session
   end
 
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   describe '#show' do
     context 'the user has not been sent an otp' do
       let(:user_phone_confirmation_session) { nil }

spec/controllers/idv/phone_controller_spec.rb

@@ -21,6 +21,12 @@
     end
   end
 
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   describe '#new' do
     let(:user) do
       build(:user, :with_phone,

spec/controllers/idv/phone_errors_controller_spec.rb

@@ -1,6 +1,12 @@
 require 'rails_helper'
 
 shared_examples_for 'an idv phone errors controller action' do
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   context 'the user is authenticated and has not confirmed their phone' do
     it 'renders the error' do
       stub_sign_in

spec/controllers/idv/recovery_controller_spec.rb

@@ -18,6 +18,12 @@
     allow(@analytics).to receive(:track_event)
   end
 
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   describe 'unauthenticated', :skip_sign_in do
     it 'redirects to the root url' do
       get :index

spec/controllers/idv/resend_otp_controller_spec.rb

@@ -24,6 +24,12 @@
     subject.idv_session.user_phone_confirmation_session = user_phone_confirmation_session
   end
 
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   describe '#create' do
     context 'the user has not selected a delivery method' do
       let(:user_phone_confirmation_session) { nil }

spec/controllers/idv/review_controller_spec.rb

@@ -45,6 +45,10 @@
         :confirm_idv_steps_complete,
       )
     end
+
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
   end
 
   describe '#confirm_idv_steps_complete' do

spec/controllers/idv/session_errors_controller_spec.rb

@@ -64,6 +64,12 @@
     allow(controller).to receive(:idv_session).and_return(idv_session)
   end
 
+  describe 'before_actions' do
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
+  end
+
   describe '#warning' do
     let(:action) { :warning }
     let(:template) { 'idv/session_errors/warning' }

spec/controllers/idv/usps_controller_spec.rb

@@ -12,6 +12,10 @@
         :confirm_mail_not_spammed,
       )
     end
+
+    it 'includes before_actions from IdvSession' do
+      expect(subject).to have_actions(:before, :sp_context_needed?)
+    end
   end
 
   describe '#index' do