Fix DocAuthBaseStep throttle target

[zachmargolis]

• Also add type checking to prevent this error in the future

Spotted by @aduth in #5302 (comment)

[aduth]

current_user doesn't always exist. See #user_id

[zachmargolis]

ah right, have to re-implement EffectiveUser

[zachmargolis]

PTAL c875a2a

[aduth]

Can we just use EffectiveUser ? Currently trying to sift through difference between flow_session and session.

c875a2a could work, but it'd be nice if we can avoid a DB call for User.find for current user like we do in EffectiveUser.

[zachmargolis]

identity-idp/app/services/flow/base_flow.rb

Line 13 in a0fb189

@flow_session = session

comes from

identity-idp/app/services/flow/flow_state_machine.rb

Line 86 in a0fb189

@flow = flow.new(self, current_session, @name)

which comes from

identity-idp/app/services/flow/flow_state_machine.rb

Lines 223 to 225 in a0fb189

	def current_session
	user_session || session
	end

So since user_session is sometimes nested, looks like no we can't just blindly use EffectiveUser :[

[zachmargolis]

New change: 1763f5e

[aduth]

So since user_session is sometimes nested, looks like no we can't just blindly use EffectiveUser :[

Ah, okay. That makes more sense. Is it reasonable that EffectiveUser could also try to pick from user_session?

[zachmargolis]

If we really wanted to re-use the EffectiveUser mixin I bet we could modify it like this?

   def effective_user_id
     [
+      respond_to?(:flow_session) && flow_session[:doc_capture_user_id],
       session[:doc_capture_user_id],
       current_user&.id,
     ].find(&:present?)
   end

[aduth]

If we really wanted to re-use the EffectiveUser mixin I bet we could modify it like this?

Yeah, I think the idea with the mixin is to try a few potential places to grab the "current" user. Your suggestion is a bit more involved than I'd expected (vs. user_session[:doc_capture_user_id] I'd hoped it was). I'd be fine to just leave things as-is.

[zachmargolis]

one issue is that the steps/flow/world is very controller-like but are not actually controllers :[