IdV API: Set last GPO code for auto-fill in local development

app/controllers/api/verify/password_confirm_controller.rb

@@ -4,16 +4,12 @@ class PasswordConfirmController < BaseController
       self.required_step = 'password_confirm'
 
       def create
-        result, personal_key = Api::ProfileCreationForm.new(
-          password: verify_params[:password],
-          jwt: verify_params[:user_bundle_token],
-          user_session: user_session,
-          service_provider: current_sp,
-        ).submit
+        result, personal_key, gpo_code = form.submit
 
         if result.success?
           user = User.find_by(uuid: result.extra[:user_uuid])
           add_proofing_component(user)
+          session[:last_gpo_confirmation_code] = gpo_code if gpo_code
           render json: {
             personal_key: personal_key,
             completion_url: completion_url(result),
@@ -25,6 +21,15 @@ def create
 
       private
 
+      def form
+        Api::ProfileCreationForm.new(
+          password: verify_params[:password],
+          jwt: verify_params[:user_bundle_token],
+          user_session: user_session,
+          service_provider: current_sp,
+        )
+      end
+
       def verify_params
         params.permit(:password, :user_bundle_token)
       end

app/forms/api/profile_creation_form.rb

@@ -6,9 +6,7 @@ class ProfileCreationForm
     validate :valid_user
     validate :valid_password
 
-    attr_reader :password, :user_bundle
-    attr_reader :user_session, :service_provider
-    attr_reader :profile
+    attr_reader :password, :user_bundle, :user_session, :service_provider, :profile, :gpo_code
 
     def initialize(password:, jwt:, user_session:, service_provider: nil)
       @password = password
@@ -32,7 +30,7 @@ def submit
         errors: errors,
         extra: extra_attributes,
       )
-      [response, personal_key]
+      [response, personal_key, gpo_code]
     end
 
     private
@@ -80,6 +78,7 @@ def create_gpo_entry
         profile: profile,
       )
       confirmation_maker.perform
+      @gpo_code = confirmation_maker.otp if FeatureManagement.reveal_gpo_code?
     end
 
     def build_profile_maker

spec/controllers/api/verify/password_confirm_controller_spec.rb

@@ -42,7 +42,7 @@ def stub_idv_session
       end
 
       it 'creates a profile and returns a key and completion url' do
-        post :create, params: { password: 'iambatman', user_bundle_token: jwt }
+        post :create, params: { password: password, user_bundle_token: jwt }
         parsed_body = JSON.parse(response.body)
         expect(parsed_body).to include(
           'personal_key' => kind_of(String),
@@ -65,7 +65,7 @@ def stub_idv_session
         end
 
         it 'creates a profile and returns completion url' do
-          post :create, params: { password: 'iambatman', user_bundle_token: jwt }
+          post :create, params: { password: password, user_bundle_token: jwt }
 
           expect(JSON.parse(response.body)['completion_url']).to eq(sign_up_completed_url)
         end
@@ -75,11 +75,37 @@ def stub_idv_session
         let(:jwt_metadata) { { vendor_phone_confirmation: false, user_phone_confirmation: false } }
 
         it 'creates a profile and returns completion url' do
-          post :create, params: { password: 'iambatman', user_bundle_token: jwt }
+          post :create, params: { password: password, user_bundle_token: jwt }
 
           expect(JSON.parse(response.body)['completion_url']).to eq(idv_come_back_later_url)
         end
       end
+
+      context 'with gpo_code returned from form submission' do
+        let(:gpo_code) { 'ABC1234' }
+
+        let(:form) do
+          Api::ProfileCreationForm.new(
+            password: password,
+            jwt: jwt_metadata,
+            user_session: {},
+            service_provider: {},
+          )
+        end
+
+        before do
+          allow(subject).to receive(:form).and_return(form)
+          allow(form).to receive(:submit).and_return(
+            [FormResponse.new(success: true, extra: { user_uuid: user.uuid }), '', gpo_code],
+          )
+        end
+
+        it 'sets code into the session' do
+          post :create, params: { password: password, user_bundle_token: jwt }
+
+          expect(session[:last_gpo_confirmation_code]).to eq(gpo_code)
+        end
+      end
     end
 
     context 'when the idv api is not enabled' do
@@ -88,7 +114,7 @@ def stub_idv_session
       end
 
       it 'responds with not found' do
-        post :create, params: { password: 'iambatman', user_bundle_token: jwt }, as: :json
+        post :create, params: { password: password, user_bundle_token: jwt }, as: :json
         expect(response.status).to eq 404
         expect(JSON.parse(response.body)['error']).
           to eq "The page you were looking for doesn't exist"

spec/forms/api/profile_creation_form_spec.rb

@@ -108,6 +108,19 @@
 
           expect(profile.gpo_confirmation_codes.first_with_otp(gpo_otp)).not_to be_nil
         end
+
+        context 'with reveal_gpo_code? feature enabled' do
+          before do
+            allow(FeatureManagement).to receive(:reveal_gpo_code?).and_return(true)
+          end
+
+          it 'returns code from the submission result the session' do
+            _response, _personal_key, actual_gpo_code = subject.submit
+            expected_gpo_code = GpoConfirmation.last.entry[:otp]
+
+            expect(actual_gpo_code).to eq(expected_gpo_code)
+          end
+        end
       end
     end