Fix Broken Personal Keys (LG-5525)

[zachmargolis]

Between #5230 and #5433, users who went through the IDV flow received broken personal keys.

This PR introduces a flow that gives these users a new personal key, so they can successfully recover their data if they forget their password.

To test this out locally or in a sandbox environment, update the user like this and then log in anywhere

window_start = IdentityConfig.store.broken_personal_key_window_start
user.active_profile.update(verified_at: window_start); user.update(encrypted_recovery_code_digest_generated_at: nil)

screenshot

[zachmargolis]

I'm not in love with a plain "_url" method having a ton of side effects, especially in such a hot path... but I wasn't sure if we had better places to insert something into the "flow" after signing in but before getting redirected elsewhere

[aduth]

I ran through the flow locally, but when testing the password reset flow, reactivating the profile with the new key produced an "Incorrect personal key" error for me.

[zachmargolis]

I ran through the flow locally, but when testing the password reset flow, reactivating the profile with the new key produced an "Incorrect personal key" error for me.

Which order did you go through the password reset flow?

The problem with resetting the password, is that for these broken personal keys, the password is the only viable way to decrypt the user's data, because the old personal key is broken. So resetting the password means that we're ophaning the data... probably need to have additional warning screens or link directly to the re-verify flow

[aduth]

Which order did you go through the password reset flow?

1. Verify account
2. Change broken_personal_key_window_finish to time after verification, before now
3. Log out
4. Log in
5. See new screen with new personal key
6. Copy key
7. Log out
8. Reset password
9. Start reactivation
10. Enter key from Step 5
11. See error "Incorrect personal key"

[zachmargolis]

• Copy key
• Reset password
• Start reactivation

Did you reset password from the account page? Or from a signed out page?

[aduth]

• Copy key
• Reset password
• Start reactivation

Did you reset password from the account page? Or from a signed out page?

Signed out. Sorry, missed that in steps. Updated them.

[zachmargolis]

I ran through the flow locally, but when testing the password reset flow, reactivating the profile with the new key produced an "Incorrect personal key" error for me.

Turns out there was a missing #save!, fixed in 3400003, thanks for the help reproducing (spec in d653a72, f733904)

[aduth]

👍