Fix DocAuthBaseStep throttle target

app/models/throttle.rb

@@ -63,6 +63,9 @@ def self.for(throttle_type:, user: nil, target: nil)
     throttle = if user
       find_or_create_by(user: user, throttle_type: throttle_type)
     elsif target
+      if !target.is_a?(String)
+        raise ArgumentError, "target must be a string, but got #{target.class}"
+      end
       find_or_create_by(target: target, throttle_type: throttle_type)
     else
       raise 'Throttle must have a user or a target, but neither were provided'

app/services/idv/steps/doc_auth_base_step.rb

@@ -53,10 +53,9 @@ def save_proofing_components
       #   DocumentCaptureSessionAsyncResult,
       #   DocumentCaptureSessionResult] response
       def extract_pii_from_doc(response)
-        current_user = User.find(user_id)
         flow_session[:pii_from_doc] = response.pii_from_doc.merge(
-          uuid: current_user.uuid,
-          phone: current_user.phone_configurations.take&.phone,
+          uuid: effective_user.uuid,
+          phone: effective_user.phone_configurations.take&.phone,
           uuid_prefix: ServiceProvider.find_by(issuer: sp_session[:issuer])&.app_id,
         )
         if response.respond_to?(:extra)
@@ -95,11 +94,17 @@ def throttled_url
 
       def throttled_else_increment
         Throttle.for(
-          target: user_id,
+          user: effective_user,
           throttle_type: :idv_acuant,
         ).throttled_else_increment?
       end
 
+      # Ideally we would not have to re-implement the EffectiveUser mixin
+      # but flow_session sometimes != controller#session
+      def effective_user
+        current_user || User.find(user_id_from_token)
+      end
+
       def user_id
         current_user ? current_user.id : user_id_from_token
       end

spec/models/throttle_spec.rb

@@ -44,6 +44,14 @@
           expect(for_target).to eq(existing)
         end
       end
+
+      context 'target is not actually a string' do
+        let(:target) { create(:user).id }
+
+        it 'raises an error' do
+          expect { for_target }.to raise_error(ArgumentError)
+        end
+      end
     end
 
     context 'when target and user are missing' do