diff --git a/app/assets/stylesheets/components/_list.scss b/app/assets/stylesheets/components/_list.scss index 34aeef3e211..318dbbc902e 100644 --- a/app/assets/stylesheets/components/_list.scss +++ b/app/assets/stylesheets/components/_list.scss @@ -27,7 +27,7 @@ } .success-bullets { - li { + .success-bullet { padding: 1rem 1rem 1rem 0; &::before { diff --git a/app/controllers/sign_up/completions_controller.rb b/app/controllers/sign_up/completions_controller.rb index 9da674a688c..f3d797e8a16 100644 --- a/app/controllers/sign_up/completions_controller.rb +++ b/app/controllers/sign_up/completions_controller.rb @@ -105,10 +105,15 @@ def email EmailContext.new(current_user).last_sign_in_email_address.email end + def all_emails + current_user.confirmed_email_addresses.map(&:email) + end + def displayable_attributes return pii_to_displayable_attributes if user_session['decrypted_pii'].present? { email: email, + all_emails: all_emails, verified_at: verified_at, x509_subject: current_user.piv_cac_configurations.first&.x509_dn_uuid, x509_issuer: current_user.piv_cac_configurations.first&.x509_issuer, diff --git a/app/presenters/openid_connect_user_info_presenter.rb b/app/presenters/openid_connect_user_info_presenter.rb index 1b15d554e68..6a9c4dbb280 100644 --- a/app/presenters/openid_connect_user_info_presenter.rb +++ b/app/presenters/openid_connect_user_info_presenter.rb @@ -14,6 +14,7 @@ def user_info iss: root_url, email: email_from_sp_identity(identity), email_verified: true, + all_emails: all_emails_from_sp_identity(identity), } info.merge!(ial2_attributes) if scoper.ial2_scopes_requested? @@ -34,7 +35,15 @@ def uuid_from_sp_identity(identity) end def email_from_sp_identity(identity) - EmailContext.new(identity.user).last_sign_in_email_address.email + email_context.last_sign_in_email_address.email + end + + def all_emails_from_sp_identity(identity) + identity.user.confirmed_email_addresses.map(&:email) + end + + def email_context + @email_context ||= EmailContext.new(identity.user) end def ial2_attributes diff --git a/app/services/openid_connect_attribute_scoper.rb b/app/services/openid_connect_attribute_scoper.rb index fa14936a093..f41db8218b2 100644 --- a/app/services/openid_connect_attribute_scoper.rb +++ b/app/services/openid_connect_attribute_scoper.rb @@ -17,12 +17,14 @@ class OpenidConnectAttributeScoper VALID_SCOPES = %w[ email + all_emails openid profile:verified_at ] + X509_SCOPES + IAL2_SCOPES VALID_IAL1_SCOPES = %w[ email + all_emails openid profile:verified_at ] + X509_SCOPES @@ -30,6 +32,7 @@ class OpenidConnectAttributeScoper ATTRIBUTE_SCOPES_MAP = { email: %w[email], email_verified: %w[email], + all_emails: %w[all_emails], address: %w[address], phone: %w[phone], phone_verified: %w[phone], diff --git a/app/view_models/sign_up_completions_show.rb b/app/view_models/sign_up_completions_show.rb index 1265e568813..5df53b3b8aa 100644 --- a/app/view_models/sign_up_completions_show.rb +++ b/app/view_models/sign_up_completions_show.rb @@ -18,6 +18,7 @@ def initialize(ial2_requested:, decorated_session:, current_user:, handoff:, ial [[:address], :address], [[:phone], :phone], [[:email], :email], + [[:all_emails], :all_emails], [[:birthdate], :birthdate], [[:social_security_number], :social_security_number], [[:x509_subject], :x509_subject], @@ -27,6 +28,7 @@ def initialize(ial2_requested:, decorated_session:, current_user:, handoff:, ial SORTED_IAL1_ATTRIBUTE_MAPPING = [ [[:email], :email], + [[:all_emails], :all_emails], [[:x509_subject], :x509_subject], [[:x509_issuer], :x509_issuer], [[:verified_at], :verified_at], @@ -69,9 +71,13 @@ def image_name end def requested_attributes_sorted - sorted_attribute_mapping.map do |raw_attribute, display_attribute| + sorted_attributes = sorted_attribute_mapping.map do |raw_attribute, display_attribute| display_attribute if (requested_attributes & raw_attribute).present? end.compact + # If the SP requests all emails, there is no reason to show them the sign + # in email address in the consent screen + sorted_attributes.delete(:email) if sorted_attributes.include?(:all_emails) + sorted_attributes end def sorted_attribute_mapping diff --git a/app/views/sign_up/completions/_requested_attributes.html.erb b/app/views/sign_up/completions/_requested_attributes.html.erb index 1b2dc586332..909dcbb3db2 100644 --- a/app/views/sign_up/completions/_requested_attributes.html.erb +++ b/app/views/sign_up/completions/_requested_attributes.html.erb @@ -1,12 +1,20 @@