From 719b9a1c7859247c7f46f415e1c2f62a0bafa828 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 28 Jul 2022 17:07:03 -0400
Subject: [PATCH 01/21] added threatmetrix domain to CSP

---
 config/initializers/content_security_policy.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 43da641dd41..2f1d5cfe11f 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -22,6 +22,8 @@
     '*.nr-data.net',
     'dap.digitalgov.gov',
     '*.google-analytics.com',
+    'h-api.online-metrix.net',
+    'h.online-metrix.net',
     IdentityConfig.store.asset_host.presence,
   ].compact
 

From 84ddc25e7a38e44e34c5fe3b2349ab558d50b0d1 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Mon, 1 Aug 2022 16:32:43 -0400
Subject: [PATCH 02/21] added script and noscript for device profiling

---
 app/views/idv/shared/_ssn.html.erb | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/app/views/idv/shared/_ssn.html.erb b/app/views/idv/shared/_ssn.html.erb
index ffef9a165ce..4ce3d90614a 100644
--- a/app/views/idv/shared/_ssn.html.erb
+++ b/app/views/idv/shared/_ssn.html.erb
@@ -28,6 +28,15 @@ locals:
   <%= new_window_link_to(t('doc_auth.instructions.learn_more'), MarketingSite.security_and_privacy_practices_url) %>
 </p>
 
+<% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
+    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<% IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=[SESSION_ID]">
+    </script>
+    <noscript>
+      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<% IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=[SESSION_ID]">
+      </iframe>
+    </noscript>
+<% end %>
+
 <% if IdentityConfig.store.proofer_mock_fallback %>
   <div class="usa-alert usa-alert--info margin-bottom-4" role="status">
     <div class="usa-alert__body">
@@ -45,6 +54,7 @@ locals:
       html: { autocomplete: 'off' },
     ) do |f| %>
   <div class="tablet:grid-col-8">
+    <%= f.hidden_field :session_id, value: "[SESSION_ID]" %>
     <%= render 'shared/ssn_field', f: f %>
   </div>
 

From 01ebbda1b4c5d5bc07541a11d18a3f64c3205450 Mon Sep 17 00:00:00 2001
From: Matt Hinz <matt.hinz@gsa.gov>
Date: Tue, 2 Aug 2022 15:55:12 -0700
Subject: [PATCH 03/21] Add speculative tests for ThreatMetrix integration

Basic tests around inclusion / non-inclusion of the TM <script> tag.
---
 spec/views/idv/shared/_ssn.html.erb_spec.rb | 127 ++++++++++++++++++++
 1 file changed, 127 insertions(+)
 create mode 100644 spec/views/idv/shared/_ssn.html.erb_spec.rb

diff --git a/spec/views/idv/shared/_ssn.html.erb_spec.rb b/spec/views/idv/shared/_ssn.html.erb_spec.rb
new file mode 100644
index 00000000000..3dfcd09ff60
--- /dev/null
+++ b/spec/views/idv/shared/_ssn.html.erb_spec.rb
@@ -0,0 +1,127 @@
+require 'rails_helper'
+
+describe 'idv/shared/_ssn.html.erb' do
+  include Devise::Test::ControllerHelpers
+  
+  let(:proofing_device_profiling_collecting_enabled) { nil }
+  let(:lexisnexis_threatmetrix_account_id) { 'test_org_id'}
+  let(:session_id) { "ABCD-1234" }
+  let(:updating_ssn) { false }
+  
+  let (:js_domain) { "h.online-metrix.net"}
+
+  let (:tags_js_url) {
+    "https://#{js_domain}/fp/tags.js?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
+  }
+
+  let (:tags_iframe_url) {
+    "https://#{js_domain}/fp/tags?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
+  }
+
+
+  let (:script_tag_rendered) {
+    expect(rendered).to have_css("script[src='#{tags_js_url}']", :visible => false)    
+  }
+
+  let (:noscript_tag_rendered) {
+    expect(rendered).to have_css("noscript iframe[src='#{tags_iframe_url}']", :visible => false)
+  }
+
+  let (:session_id_input_rendered) {
+    expect(rendered).to have_css("input[type=hidden][name='session_id'][value='#{session_id}']", :visible => false)
+  }
+
+  let (:script_tag_not_rendered) {
+    expect(rendered).not_to have_css("script[src*='#{js_domain}']", :visible => false)    
+  }
+
+  let (:noscript_tag_not_rendered) {
+    expect(rendered).not_to have_css("noscript iframe[src*='#{js_domain}']", :visible => false)
+  }
+
+  let (:session_id_input_not_rendered) {
+    expect(rendered).not_to have_css('input[name="session_id"]', :visible => false)
+  }
+
+  before :each do
+    allow(view).to receive(:url_for).and_return('https://example.com/')
+    allow(IdentityConfig.store).to receive(:proofing_device_profiling_collecting_enabled?).and_return(proofing_device_profiling_collecting_enabled)
+    allow(IdentityConfig.store).to receive(:lexisnexis_threatmetrix_account_id).and_return(lexisnexis_threatmetrix_account_id)
+
+    render partial: 'idv/shared/ssn', locals: {
+      flow_session: {},
+      success_alert_enabled: false,
+
+      session_id: session_id,
+      updating_ssn: updating_ssn,
+    }
+  end
+
+  context 'when threatmetrix collection enabled' do
+    let(:proofing_device_profiling_collecting_enabled) { true }
+
+    context 'and org id specified' do
+      context 'and entering ssn for the first time' do
+        describe '<script> tag' do
+          it 'is rendered' do
+            script_tag_rendered
+          end
+        end
+
+        describe '<noscript> tag' do
+          it 'is rendered' do
+            noscript_tag_rendered
+          end
+        end
+
+        describe 'session_id input' do
+          it 'is rendered' do
+            session_id_input_rendered
+          end
+        end
+      end
+
+      context 'updating ssn already entered' do
+        let(:updating_ssn) { true }
+
+        it 'does not render <script> tag' do
+          script_tag_not_rendered
+        end
+        it 'does not render <noscript> tag' do
+          noscript_tag_not_rendered
+        end
+        it 'does not render session_id input' do
+          session_id_input_not_rendered
+        end
+      end
+    end
+
+    context 'org id not specified' do
+      let(:lexisnexis_threatmetrix_account_id) { '' }
+
+      it 'does not render <script> tag' do
+        script_tag_not_rendered
+      end
+      it 'does not render <noscript> tag' do
+        noscript_tag_not_rendered
+      end
+      it 'does not render session_id input' do
+        session_id_input_not_rendered
+      end
+  end
+  end
+
+  context 'threatmetrix collection disabled' do
+    let(:proofing_device_profiling_collecting_enabled) { false }
+
+    it 'does not render <script> tag' do
+      script_tag_not_rendered
+    end
+    it 'does not render <noscript> tag' do
+      noscript_tag_not_rendered
+    end
+    it 'does not render session_id input' do
+      session_id_input_not_rendered
+    end
+  end
+end

From 2908bc7962020d0542baa73c101dd8a6518f75cf Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Wed, 3 Aug 2022 13:52:15 -0400
Subject: [PATCH 04/21] Added session_id to ssn page

---
 app/services/idv/steps/ssn_step.rb  | 7 +++++++
 app/views/idv/doc_auth/ssn.html.erb | 2 +-
 app/views/idv/shared/_ssn.html.erb  | 6 +++---
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/app/services/idv/steps/ssn_step.rb b/app/services/idv/steps/ssn_step.rb
index a1fb7cf3af2..ded91913ca7 100644
--- a/app/services/idv/steps/ssn_step.rb
+++ b/app/services/idv/steps/ssn_step.rb
@@ -12,6 +12,7 @@ def call
       def extra_view_variables
         {
           updating_ssn: flow_session.dig(:pii_from_doc, :ssn).present?,
+          threatmetrix_session_id: threatmetrix_session_id,
         }
       end
 
@@ -29,6 +30,12 @@ def invalid_state_response
         mark_step_incomplete(:document_capture)
         FormResponse.new(success: false)
       end
+
+      private
+
+      def threatmetrix_session_id
+        SecureRandom.uuid
+      end
     end
   end
 end
diff --git a/app/views/idv/doc_auth/ssn.html.erb b/app/views/idv/doc_auth/ssn.html.erb
index 22e2f37ac4e..148aaedde4a 100644
--- a/app/views/idv/doc_auth/ssn.html.erb
+++ b/app/views/idv/doc_auth/ssn.html.erb
@@ -1 +1 @@
-<%= render 'idv/shared/ssn', flow_session: flow_session, success_alert_enabled: !updating_ssn, updating_ssn: updating_ssn %>
+<%= render 'idv/shared/ssn', flow_session: flow_session, success_alert_enabled: !updating_ssn, updating_ssn: updating_ssn, threatmetrix_session_id: threatmetrix_session_id %>
diff --git a/app/views/idv/shared/_ssn.html.erb b/app/views/idv/shared/_ssn.html.erb
index 4ce3d90614a..edf184affdf 100644
--- a/app/views/idv/shared/_ssn.html.erb
+++ b/app/views/idv/shared/_ssn.html.erb
@@ -29,10 +29,10 @@ locals:
 </p>
 
 <% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
-    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<% IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=[SESSION_ID]">
+      <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<% IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<% threatmetrix_session_id %>">
     </script>
     <noscript>
-      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<% IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=[SESSION_ID]">
+      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<% IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<% threatmetrix_session_id %>">
       </iframe>
     </noscript>
 <% end %>
@@ -54,7 +54,7 @@ locals:
       html: { autocomplete: 'off' },
     ) do |f| %>
   <div class="tablet:grid-col-8">
-    <%= f.hidden_field :session_id, value: "[SESSION_ID]" %>
+    <%= f.hidden_field :session_id, value: threatmetrix_session_id %>
     <%= render 'shared/ssn_field', f: f %>
   </div>
 

From ddd0ef069ae9201655098d406497db2a7993850c Mon Sep 17 00:00:00 2001
From: Matt Hinz <matt.hinz@gsa.gov>
Date: Wed, 3 Aug 2022 11:12:25 -0700
Subject: [PATCH 05/21] Update ThreatMetrix JS include tests

Get _most_ of them passing
---
 app/views/idv/shared/_ssn.html.erb          |  6 +++---
 spec/views/idv/shared/_ssn.html.erb_spec.rb | 11 +++++------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/app/views/idv/shared/_ssn.html.erb b/app/views/idv/shared/_ssn.html.erb
index edf184affdf..e0e07933e21 100644
--- a/app/views/idv/shared/_ssn.html.erb
+++ b/app/views/idv/shared/_ssn.html.erb
@@ -29,10 +29,10 @@ locals:
 </p>
 
 <% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
-      <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<% IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<% threatmetrix_session_id %>">
+      <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= threatmetrix_session_id %>">
     </script>
     <noscript>
-      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<% IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<% threatmetrix_session_id %>">
+      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= threatmetrix_session_id %>">
       </iframe>
     </noscript>
 <% end %>
@@ -54,7 +54,7 @@ locals:
       html: { autocomplete: 'off' },
     ) do |f| %>
   <div class="tablet:grid-col-8">
-    <%= f.hidden_field :session_id, value: threatmetrix_session_id %>
+    <%= f.hidden_field :threatmetrix_session_id, value: threatmetrix_session_id %>
     <%= render 'shared/ssn_field', f: f %>
   </div>
 
diff --git a/spec/views/idv/shared/_ssn.html.erb_spec.rb b/spec/views/idv/shared/_ssn.html.erb_spec.rb
index 3dfcd09ff60..9100d8efada 100644
--- a/spec/views/idv/shared/_ssn.html.erb_spec.rb
+++ b/spec/views/idv/shared/_ssn.html.erb_spec.rb
@@ -18,7 +18,6 @@
     "https://#{js_domain}/fp/tags?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
   }
 
-
   let (:script_tag_rendered) {
     expect(rendered).to have_css("script[src='#{tags_js_url}']", :visible => false)    
   }
@@ -28,7 +27,7 @@
   }
 
   let (:session_id_input_rendered) {
-    expect(rendered).to have_css("input[type=hidden][name='session_id'][value='#{session_id}']", :visible => false)
+    expect(rendered).to have_css("input[type=hidden][name='doc_auth[threatmetrix_session_id]'][value='#{session_id}']", :visible => false)
   }
 
   let (:script_tag_not_rendered) {
@@ -40,19 +39,19 @@
   }
 
   let (:session_id_input_not_rendered) {
-    expect(rendered).not_to have_css('input[name="session_id"]', :visible => false)
+    expect(rendered).not_to have_css('input[name="doc_auth[threatmetrix_session_id]"]', :visible => false)
   }
 
   before :each do
     allow(view).to receive(:url_for).and_return('https://example.com/')
-    allow(IdentityConfig.store).to receive(:proofing_device_profiling_collecting_enabled?).and_return(proofing_device_profiling_collecting_enabled)
+    
+    allow(IdentityConfig.store).to receive(:proofing_device_profiling_collecting_enabled).and_return(proofing_device_profiling_collecting_enabled)
     allow(IdentityConfig.store).to receive(:lexisnexis_threatmetrix_account_id).and_return(lexisnexis_threatmetrix_account_id)
 
     render partial: 'idv/shared/ssn', locals: {
       flow_session: {},
       success_alert_enabled: false,
-
-      session_id: session_id,
+      threatmetrix_session_id: session_id,
       updating_ssn: updating_ssn,
     }
   end

From 227a018664432680bab286acaf37beea0a9f5ae9 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 4 Aug 2022 13:51:03 -0400
Subject: [PATCH 06/21] Fix linting errors. Make tests pass

---
 app/views/idv/shared/_ssn.html.erb          | 12 +++--
 spec/views/idv/shared/_ssn.html.erb_spec.rb | 53 ++++++++++++---------
 2 files changed, 39 insertions(+), 26 deletions(-)

diff --git a/app/views/idv/shared/_ssn.html.erb b/app/views/idv/shared/_ssn.html.erb
index e0e07933e21..f3840689007 100644
--- a/app/views/idv/shared/_ssn.html.erb
+++ b/app/views/idv/shared/_ssn.html.erb
@@ -28,13 +28,15 @@ locals:
   <%= new_window_link_to(t('doc_auth.instructions.learn_more'), MarketingSite.security_and_privacy_practices_url) %>
 </p>
 
-<% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
-      <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= threatmetrix_session_id %>">
+<% if IdentityConfig.store.proofing_device_profiling_collecting_enabled && !updating_ssn %>
+  <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? %>
+    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= threatmetrix_session_id %>">
     </script>
     <noscript>
       <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= threatmetrix_session_id %>">
       </iframe>
     </noscript>
+  <% end %>
 <% end %>
 
 <% if IdentityConfig.store.proofer_mock_fallback %>
@@ -54,7 +56,11 @@ locals:
       html: { autocomplete: 'off' },
     ) do |f| %>
   <div class="tablet:grid-col-8">
-    <%= f.hidden_field :threatmetrix_session_id, value: threatmetrix_session_id %>
+    <% if IdentityConfig.store.proofing_device_profiling_collecting_enabled && !updating_ssn %>
+      <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? %>
+        <%= f.hidden_field :threatmetrix_session_id, value: threatmetrix_session_id %>
+      <% end %>
+    <% end %>
     <%= render 'shared/ssn_field', f: f %>
   </div>
 
diff --git a/spec/views/idv/shared/_ssn.html.erb_spec.rb b/spec/views/idv/shared/_ssn.html.erb_spec.rb
index 9100d8efada..a4818a9565a 100644
--- a/spec/views/idv/shared/_ssn.html.erb_spec.rb
+++ b/spec/views/idv/shared/_ssn.html.erb_spec.rb
@@ -2,51 +2,58 @@
 
 describe 'idv/shared/_ssn.html.erb' do
   include Devise::Test::ControllerHelpers
-  
+
   let(:proofing_device_profiling_collecting_enabled) { nil }
-  let(:lexisnexis_threatmetrix_account_id) { 'test_org_id'}
-  let(:session_id) { "ABCD-1234" }
+  let(:lexisnexis_threatmetrix_account_id) { 'test_org_id' }
+  let(:session_id) { 'ABCD-1234' }
   let(:updating_ssn) { false }
-  
-  let (:js_domain) { "h.online-metrix.net"}
+  let(:js_domain) { 'h.online-metrix.net' }
 
-  let (:tags_js_url) {
+  let(:tags_js_url) {
     "https://#{js_domain}/fp/tags.js?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
   }
 
-  let (:tags_iframe_url) {
+  let(:tags_iframe_url) {
     "https://#{js_domain}/fp/tags?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
   }
 
-  let (:script_tag_rendered) {
-    expect(rendered).to have_css("script[src='#{tags_js_url}']", :visible => false)    
+  let(:script_tag_rendered) {
+    expect(rendered).to have_css("script[src='#{tags_js_url}']", visible: false)
   }
 
-  let (:noscript_tag_rendered) {
-    expect(rendered).to have_css("noscript iframe[src='#{tags_iframe_url}']", :visible => false)
+  let(:noscript_tag_rendered) {
+    expect(rendered).to have_css("noscript iframe[src='#{tags_iframe_url}']", visible: false)
   }
 
-  let (:session_id_input_rendered) {
-    expect(rendered).to have_css("input[type=hidden][name='doc_auth[threatmetrix_session_id]'][value='#{session_id}']", :visible => false)
+  let(:session_id_input_rendered) {
+    expect(rendered).
+      to have_css(
+        "input[type=hidden][name='doc_auth[threatmetrix_session_id]'][value='#{session_id}']",
+        visible: false,
+      )
   }
 
-  let (:script_tag_not_rendered) {
-    expect(rendered).not_to have_css("script[src*='#{js_domain}']", :visible => false)    
+  let(:script_tag_not_rendered) {
+    expect(rendered).not_to have_css("script[src*='#{js_domain}']", visible: false)
   }
 
-  let (:noscript_tag_not_rendered) {
-    expect(rendered).not_to have_css("noscript iframe[src*='#{js_domain}']", :visible => false)
+  let(:noscript_tag_not_rendered) {
+    expect(rendered).not_to have_css("noscript iframe[src*='#{js_domain}']", visible: false)
   }
 
-  let (:session_id_input_not_rendered) {
-    expect(rendered).not_to have_css('input[name="doc_auth[threatmetrix_session_id]"]', :visible => false)
+  let(:session_id_input_not_rendered) {
+    expect(rendered).
+      not_to have_css('input[name="doc_auth[threatmetrix_session_id]"]', visible: false)
   }
 
   before :each do
     allow(view).to receive(:url_for).and_return('https://example.com/')
-    
-    allow(IdentityConfig.store).to receive(:proofing_device_profiling_collecting_enabled).and_return(proofing_device_profiling_collecting_enabled)
-    allow(IdentityConfig.store).to receive(:lexisnexis_threatmetrix_account_id).and_return(lexisnexis_threatmetrix_account_id)
+
+    allow(IdentityConfig.store).
+      to receive(:proofing_device_profiling_collecting_enabled).
+      and_return(proofing_device_profiling_collecting_enabled)
+    allow(IdentityConfig.store).
+      to receive(:lexisnexis_threatmetrix_account_id).and_return(lexisnexis_threatmetrix_account_id)
 
     render partial: 'idv/shared/ssn', locals: {
       flow_session: {},
@@ -107,7 +114,7 @@
       it 'does not render session_id input' do
         session_id_input_not_rendered
       end
-  end
+    end
   end
 
   context 'threatmetrix collection disabled' do

From e20904d2aef03bbfe8a89a6f5125bc530abb58f7 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 4 Aug 2022 14:02:05 -0400
Subject: [PATCH 07/21] moved around logic for checking if TM org_id is
 available

---
 app/views/idv/shared/_ssn.html.erb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/views/idv/shared/_ssn.html.erb b/app/views/idv/shared/_ssn.html.erb
index f3840689007..af54338abc9 100644
--- a/app/views/idv/shared/_ssn.html.erb
+++ b/app/views/idv/shared/_ssn.html.erb
@@ -28,8 +28,8 @@ locals:
   <%= new_window_link_to(t('doc_auth.instructions.learn_more'), MarketingSite.security_and_privacy_practices_url) %>
 </p>
 
-<% if IdentityConfig.store.proofing_device_profiling_collecting_enabled && !updating_ssn %>
-  <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? %>
+<% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
+  <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? || updating_ssn %>
     <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= threatmetrix_session_id %>">
     </script>
     <noscript>
@@ -56,8 +56,8 @@ locals:
       html: { autocomplete: 'off' },
     ) do |f| %>
   <div class="tablet:grid-col-8">
-    <% if IdentityConfig.store.proofing_device_profiling_collecting_enabled && !updating_ssn %>
-      <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? %>
+    <% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
+      <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? || updating_ssn %>
         <%= f.hidden_field :threatmetrix_session_id, value: threatmetrix_session_id %>
       <% end %>
     <% end %>

From 1b6047b7d2bd324059f79db28a12c76f015cff97 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 4 Aug 2022 14:11:38 -0400
Subject: [PATCH 08/21] update changelog

changelog: Upcoming Features, Device Profiling, Add ThreatMetrix device profiling to ssn page

From 32a885b3f902eead1f782457c3c02badb0802f41 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 4 Aug 2022 15:51:14 -0400
Subject: [PATCH 09/21] added feature flags on csp and threatmetrix session id

---
 app/services/idv/steps/ssn_step.rb             | 3 +--
 config/initializers/content_security_policy.rb | 6 ++++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/app/services/idv/steps/ssn_step.rb b/app/services/idv/steps/ssn_step.rb
index ded91913ca7..75eaf0e8e87 100644
--- a/app/services/idv/steps/ssn_step.rb
+++ b/app/services/idv/steps/ssn_step.rb
@@ -31,9 +31,8 @@ def invalid_state_response
         FormResponse.new(success: false)
       end
 
-      private
-
       def threatmetrix_session_id
+        return nil if !IdentityConfig.store.proofing_device_profiling_collecting_enabled
         SecureRandom.uuid
       end
     end
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 2f1d5cfe11f..91b1c08c1e2 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -22,11 +22,13 @@
     '*.nr-data.net',
     'dap.digitalgov.gov',
     '*.google-analytics.com',
-    'h-api.online-metrix.net',
-    'h.online-metrix.net',
     IdentityConfig.store.asset_host.presence,
   ].compact
 
+  if IdentityConfig.store.proofing_device_profiling_collecting_enabled
+    script_src << 'h.online-metrix.net'
+  end
+
   script_src = [:self, :unsafe_eval] if !Rails.env.production?
 
   style_src = [:self, IdentityConfig.store.asset_host.presence].compact

From 10ecc4e71b4e203d5622b2dd4144e38d898b8b2c Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 4 Aug 2022 17:22:28 -0400
Subject: [PATCH 10/21] move threatmetrix_session_id into flow session

allow the threatmetrix_session to persist in flow session
---
 app/services/idv/steps/ssn_step.rb          |  5 ++++-
 app/views/idv/shared/_ssn.html.erb          |  9 ++-------
 spec/views/idv/shared/_ssn.html.erb_spec.rb | 20 +++-----------------
 3 files changed, 9 insertions(+), 25 deletions(-)

diff --git a/app/services/idv/steps/ssn_step.rb b/app/services/idv/steps/ssn_step.rb
index 75eaf0e8e87..c3d95d6785d 100644
--- a/app/services/idv/steps/ssn_step.rb
+++ b/app/services/idv/steps/ssn_step.rb
@@ -7,12 +7,15 @@ def call
         return invalid_state_response if invalid_state?
 
         flow_session[:pii_from_doc][:ssn] = flow_params[:ssn]
+
+        if IdentityConfig.store.proofing_device_profiling_collecting_enabled
+          flow_session[:threatmetrix_session_id] = threatmetrix_session_id
+        end
       end
 
       def extra_view_variables
         {
           updating_ssn: flow_session.dig(:pii_from_doc, :ssn).present?,
-          threatmetrix_session_id: threatmetrix_session_id,
         }
       end
 
diff --git a/app/views/idv/shared/_ssn.html.erb b/app/views/idv/shared/_ssn.html.erb
index af54338abc9..e53995e8e45 100644
--- a/app/views/idv/shared/_ssn.html.erb
+++ b/app/views/idv/shared/_ssn.html.erb
@@ -30,10 +30,10 @@ locals:
 
 <% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
   <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? || updating_ssn %>
-    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= threatmetrix_session_id %>">
+    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
     </script>
     <noscript>
-      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= threatmetrix_session_id %>">
+      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
       </iframe>
     </noscript>
   <% end %>
@@ -56,11 +56,6 @@ locals:
       html: { autocomplete: 'off' },
     ) do |f| %>
   <div class="tablet:grid-col-8">
-    <% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
-      <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? || updating_ssn %>
-        <%= f.hidden_field :threatmetrix_session_id, value: threatmetrix_session_id %>
-      <% end %>
-    <% end %>
     <%= render 'shared/ssn_field', f: f %>
   </div>
 
diff --git a/spec/views/idv/shared/_ssn.html.erb_spec.rb b/spec/views/idv/shared/_ssn.html.erb_spec.rb
index a4818a9565a..c58eb04aac6 100644
--- a/spec/views/idv/shared/_ssn.html.erb_spec.rb
+++ b/spec/views/idv/shared/_ssn.html.erb_spec.rb
@@ -56,9 +56,10 @@
       to receive(:lexisnexis_threatmetrix_account_id).and_return(lexisnexis_threatmetrix_account_id)
 
     render partial: 'idv/shared/ssn', locals: {
-      flow_session: {},
+      flow_session: {
+        threatmetrix_session_id: session_id,
+      },
       success_alert_enabled: false,
-      threatmetrix_session_id: session_id,
       updating_ssn: updating_ssn,
     }
   end
@@ -79,12 +80,6 @@
             noscript_tag_rendered
           end
         end
-
-        describe 'session_id input' do
-          it 'is rendered' do
-            session_id_input_rendered
-          end
-        end
       end
 
       context 'updating ssn already entered' do
@@ -96,9 +91,6 @@
         it 'does not render <noscript> tag' do
           noscript_tag_not_rendered
         end
-        it 'does not render session_id input' do
-          session_id_input_not_rendered
-        end
       end
     end
 
@@ -111,9 +103,6 @@
       it 'does not render <noscript> tag' do
         noscript_tag_not_rendered
       end
-      it 'does not render session_id input' do
-        session_id_input_not_rendered
-      end
     end
   end
 
@@ -126,8 +115,5 @@
     it 'does not render <noscript> tag' do
       noscript_tag_not_rendered
     end
-    it 'does not render session_id input' do
-      session_id_input_not_rendered
-    end
   end
 end

From 82ee43cfcb1cef49e63841ed4f9519003d64c657 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 4 Aug 2022 20:55:44 -0400
Subject: [PATCH 11/21] fixup

---
 app/views/idv/doc_auth/ssn.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/idv/doc_auth/ssn.html.erb b/app/views/idv/doc_auth/ssn.html.erb
index 148aaedde4a..22e2f37ac4e 100644
--- a/app/views/idv/doc_auth/ssn.html.erb
+++ b/app/views/idv/doc_auth/ssn.html.erb
@@ -1 +1 @@
-<%= render 'idv/shared/ssn', flow_session: flow_session, success_alert_enabled: !updating_ssn, updating_ssn: updating_ssn, threatmetrix_session_id: threatmetrix_session_id %>
+<%= render 'idv/shared/ssn', flow_session: flow_session, success_alert_enabled: !updating_ssn, updating_ssn: updating_ssn %>

From aec8ab8af84a71caeb090e5fe275cb7e51f295d7 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 4 Aug 2022 23:28:44 -0400
Subject: [PATCH 12/21] Update config/initializers/content_security_policy.rb

Co-authored-by: Matt Hinz <matthinz@gmail.com>
---
 config/initializers/content_security_policy.rb | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 91b1c08c1e2..43da641dd41 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -25,10 +25,6 @@
     IdentityConfig.store.asset_host.presence,
   ].compact
 
-  if IdentityConfig.store.proofing_device_profiling_collecting_enabled
-    script_src << 'h.online-metrix.net'
-  end
-
   script_src = [:self, :unsafe_eval] if !Rails.env.production?
 
   style_src = [:self, IdentityConfig.store.asset_host.presence].compact

From a14ee083b61a1dc2531fb4695b9db21b143ef21d Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Mon, 8 Aug 2022 15:54:26 -0400
Subject: [PATCH 13/21] changed lexisnexis_account_id to org_id

---
 app/views/idv/shared/_ssn.html.erb | 6 +++---
 config/application.yml.default     | 2 +-
 lib/identity_config.rb             | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/views/idv/shared/_ssn.html.erb b/app/views/idv/shared/_ssn.html.erb
index e53995e8e45..79c13468532 100644
--- a/app/views/idv/shared/_ssn.html.erb
+++ b/app/views/idv/shared/_ssn.html.erb
@@ -29,11 +29,11 @@ locals:
 </p>
 
 <% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
-  <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? || updating_ssn %>
-    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
+  <% unless IdentityConfig.store.lexisnexis_threatmetrix_org_id.empty? || updating_ssn %>
+    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_org_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
     </script>
     <noscript>
-      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
+      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_org_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
       </iframe>
     </noscript>
   <% end %>
diff --git a/config/application.yml.default b/config/application.yml.default
index c5fa94eb4e5..8fe7bf35548 100644
--- a/config/application.yml.default
+++ b/config/application.yml.default
@@ -144,7 +144,7 @@ lexisnexis_trueid_noliveness_nocropping_workflow: customers.gsa.trueid.workflow
 # LexisNexis ThreatMetrix ##########################################
 lexisnexis_threatmetrix_base_url: https://www.example.com
 lexisnexis_threatmetrix_request_mode: testing
-lexisnexis_threatmetrix_account_id: test_account
+lexisnexis_threatmetrix_org_id: test_account
 lexisnexis_threatmetrix_username: test_username
 lexisnexis_threatmetrix_password: test_password
 lexisnexis_threatmetrix_instant_verify_timeout: 1.0
diff --git a/lib/identity_config.rb b/lib/identity_config.rb
index 558c077b7c0..c2214884a3f 100644
--- a/lib/identity_config.rb
+++ b/lib/identity_config.rb
@@ -212,7 +212,7 @@ def self.build_store(config_map)
     config.add(:lexisnexis_trueid_timeout, type: :float)
     config.add(:lexisnexis_threatmetrix_base_url, type: :string)
     config.add(:lexisnexis_threatmetrix_request_mode, type: :string)
-    config.add(:lexisnexis_threatmetrix_account_id, type: :string)
+    config.add(:lexisnexis_threatmetrix_org_id, type: :string)
     config.add(:lexisnexis_threatmetrix_username, type: :string)
     config.add(:lexisnexis_threatmetrix_password, type: :string)
     config.add(:lexisnexis_threatmetrix_instant_verify_timeout, type: :float)

From 70604392609145ad2751e3aaab23ec8eac94ef96 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Mon, 8 Aug 2022 16:34:15 -0400
Subject: [PATCH 14/21] moved test expectations into methods

---
 spec/views/idv/shared/_ssn.html.erb_spec.rb | 84 ++++++++++-----------
 1 file changed, 42 insertions(+), 42 deletions(-)

diff --git a/spec/views/idv/shared/_ssn.html.erb_spec.rb b/spec/views/idv/shared/_ssn.html.erb_spec.rb
index c58eb04aac6..55e9c13af5f 100644
--- a/spec/views/idv/shared/_ssn.html.erb_spec.rb
+++ b/spec/views/idv/shared/_ssn.html.erb_spec.rb
@@ -4,46 +4,17 @@
   include Devise::Test::ControllerHelpers
 
   let(:proofing_device_profiling_collecting_enabled) { nil }
-  let(:lexisnexis_threatmetrix_account_id) { 'test_org_id' }
+  let(:lexisnexis_threatmetrix_org_id) { 'test_org_id' }
   let(:session_id) { 'ABCD-1234' }
   let(:updating_ssn) { false }
   let(:js_domain) { 'h.online-metrix.net' }
 
   let(:tags_js_url) {
-    "https://#{js_domain}/fp/tags.js?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
+    "https://#{js_domain}/fp/tags.js?org_id=#{lexisnexis_threatmetrix_org_id}&session_id=#{session_id}"
   }
 
   let(:tags_iframe_url) {
-    "https://#{js_domain}/fp/tags?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
-  }
-
-  let(:script_tag_rendered) {
-    expect(rendered).to have_css("script[src='#{tags_js_url}']", visible: false)
-  }
-
-  let(:noscript_tag_rendered) {
-    expect(rendered).to have_css("noscript iframe[src='#{tags_iframe_url}']", visible: false)
-  }
-
-  let(:session_id_input_rendered) {
-    expect(rendered).
-      to have_css(
-        "input[type=hidden][name='doc_auth[threatmetrix_session_id]'][value='#{session_id}']",
-        visible: false,
-      )
-  }
-
-  let(:script_tag_not_rendered) {
-    expect(rendered).not_to have_css("script[src*='#{js_domain}']", visible: false)
-  }
-
-  let(:noscript_tag_not_rendered) {
-    expect(rendered).not_to have_css("noscript iframe[src*='#{js_domain}']", visible: false)
-  }
-
-  let(:session_id_input_not_rendered) {
-    expect(rendered).
-      not_to have_css('input[name="doc_auth[threatmetrix_session_id]"]', visible: false)
+    "https://#{js_domain}/fp/tags?org_id=#{lexisnexis_threatmetrix_org_id}&session_id=#{session_id}"
   }
 
   before :each do
@@ -53,7 +24,7 @@
       to receive(:proofing_device_profiling_collecting_enabled).
       and_return(proofing_device_profiling_collecting_enabled)
     allow(IdentityConfig.store).
-      to receive(:lexisnexis_threatmetrix_account_id).and_return(lexisnexis_threatmetrix_account_id)
+      to receive(:lexisnexis_threatmetrix_org_id).and_return(lexisnexis_threatmetrix_org_id)
 
     render partial: 'idv/shared/ssn', locals: {
       flow_session: {
@@ -71,13 +42,13 @@
       context 'and entering ssn for the first time' do
         describe '<script> tag' do
           it 'is rendered' do
-            script_tag_rendered
+            expect_script_tag_rendered
           end
         end
 
         describe '<noscript> tag' do
           it 'is rendered' do
-            noscript_tag_rendered
+            expect_noscript_tag_rendered
           end
         end
       end
@@ -86,22 +57,22 @@
         let(:updating_ssn) { true }
 
         it 'does not render <script> tag' do
-          script_tag_not_rendered
+          expect_script_tag_not_rendered
         end
         it 'does not render <noscript> tag' do
-          noscript_tag_not_rendered
+          expect_noscript_tag_not_rendered
         end
       end
     end
 
     context 'org id not specified' do
-      let(:lexisnexis_threatmetrix_account_id) { '' }
+      let(:lexisnexis_threatmetrix_org_id) { '' }
 
       it 'does not render <script> tag' do
-        script_tag_not_rendered
+        expect_script_tag_not_rendered
       end
       it 'does not render <noscript> tag' do
-        noscript_tag_not_rendered
+        expect_noscript_tag_not_rendered
       end
     end
   end
@@ -110,10 +81,39 @@
     let(:proofing_device_profiling_collecting_enabled) { false }
 
     it 'does not render <script> tag' do
-      script_tag_not_rendered
+      expect_script_tag_not_rendered
     end
     it 'does not render <noscript> tag' do
-      noscript_tag_not_rendered
+      expect_noscript_tag_not_rendered
     end
   end
+
+  def expect_script_tag_rendered
+    expect(rendered).to have_css("script[src='#{tags_js_url}']", visible: false)
+  end
+
+  def expect_noscript_tag_rendered
+    expect(rendered).to have_css("noscript iframe[src='#{tags_iframe_url}']", visible: false)
+  end
+
+  def expect_session_id_input_rendered
+    expect(rendered).
+      to have_css(
+        "input[type=hidden][name='doc_auth[threatmetrix_session_id]'][value='#{session_id}']",
+        visible: false,
+      )
+  end
+
+  def expect_script_tag_not_rendered
+    expect(rendered).not_to have_css("script[src*='#{js_domain}']", visible: false)
+  end
+
+  def expect_noscript_tag_not_rendered
+    expect(rendered).not_to have_css("noscript iframe[src*='#{js_domain}']", visible: false)
+  end
+
+  def expect_session_id_input_not_rendered
+    expect(rendered).
+      not_to have_css('input[name="doc_auth[threatmetrix_session_id]"]', visible: false)
+  end
 end

From 75516f4e16fc60d0722a43382b5cbc347ffdfe08 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Tue, 9 Aug 2022 09:56:18 -0400
Subject: [PATCH 15/21] add threatmetrix_session_id to ipp flow

---
 app/services/idv/steps/ipp/ssn_step.rb | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/app/services/idv/steps/ipp/ssn_step.rb b/app/services/idv/steps/ipp/ssn_step.rb
index 1b4b95a4b58..38e9d6cd4aa 100644
--- a/app/services/idv/steps/ipp/ssn_step.rb
+++ b/app/services/idv/steps/ipp/ssn_step.rb
@@ -6,6 +6,10 @@ class SsnStep < DocAuthBaseStep
 
         def call
           flow_session[:pii_from_user][:ssn] = flow_params[:ssn]
+
+          if IdentityConfig.store.proofing_device_profiling_collecting_enabled
+            flow_session[:threatmetrix_session_id] = threatmetrix_session_id
+          end
         end
 
         def extra_view_variables
@@ -19,6 +23,11 @@ def extra_view_variables
         def form_submit
           Idv::SsnFormatForm.new(current_user).submit(permit(:ssn))
         end
+
+        def threatmetrix_session_id
+          return nil if !IdentityConfig.store.proofing_device_profiling_collecting_enabled
+          SecureRandom.uuid
+        end
       end
     end
   end

From b2bf7179a6af2aaa9cbecd976790844982cffe45 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Tue, 9 Aug 2022 12:19:51 -0400
Subject: [PATCH 16/21] dont create a new session id if updating_ssn

---
 app/services/idv/steps/ipp/ssn_step.rb | 12 +++++++-----
 app/services/idv/steps/ssn_step.rb     | 10 ++++++----
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/app/services/idv/steps/ipp/ssn_step.rb b/app/services/idv/steps/ipp/ssn_step.rb
index 5ee7bbeae07..626bf4ea8ea 100644
--- a/app/services/idv/steps/ipp/ssn_step.rb
+++ b/app/services/idv/steps/ipp/ssn_step.rb
@@ -7,16 +7,14 @@ class SsnStep < DocAuthBaseStep
         def call
           flow_session[:pii_from_user][:ssn] = flow_params[:ssn]
 
-          if IdentityConfig.store.proofing_device_profiling_collecting_enabled
-            flow_session[:threatmetrix_session_id] = threatmetrix_session_id
-          end
+          flow_session[:threatmetrix_session_id] = threatmetrix_session_id unless updating_ssn
 
           idv_session.delete('applicant')
         end
 
         def extra_view_variables
           {
-            updating_ssn: flow_session[:pii_from_user][:ssn].present?,
+            updating_ssn: updating_ssn,
           }
         end
 
@@ -26,8 +24,12 @@ def form_submit
           Idv::SsnFormatForm.new(current_user).submit(permit(:ssn))
         end
 
+        def updating_ssn
+          flow_session.dig(:pii_from_doc, :ssn).present?
+        end
+
         def threatmetrix_session_id
-          return nil if !IdentityConfig.store.proofing_device_profiling_collecting_enabled
+          return unless IdentityConfig.store.proofing_device_profiling_collecting_enabled
           SecureRandom.uuid
         end
       end
diff --git a/app/services/idv/steps/ssn_step.rb b/app/services/idv/steps/ssn_step.rb
index 43732d26f76..aa718a02808 100644
--- a/app/services/idv/steps/ssn_step.rb
+++ b/app/services/idv/steps/ssn_step.rb
@@ -8,16 +8,14 @@ def call
 
         flow_session[:pii_from_doc][:ssn] = flow_params[:ssn]
 
-        if IdentityConfig.store.proofing_device_profiling_collecting_enabled
-          flow_session[:threatmetrix_session_id] = threatmetrix_session_id
-        end
+        flow_session[:threatmetrix_session_id] = threatmetrix_session_id unless updating_ssn
 
         idv_session.delete('applicant')
       end
 
       def extra_view_variables
         {
-          updating_ssn: flow_session.dig(:pii_from_doc, :ssn).present?,
+          updating_ssn: updating_ssn,
         }
       end
 
@@ -31,6 +29,10 @@ def invalid_state?
         flow_session[:pii_from_doc].nil?
       end
 
+      def updating_ssn
+        flow_session.dig(:pii_from_doc, :ssn).present?
+      end
+
       def invalid_state_response
         mark_step_incomplete(:document_capture)
         FormResponse.new(success: false)

From c940d22eccf9215015c3af975995b3191a178334 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Tue, 9 Aug 2022 13:26:53 -0400
Subject: [PATCH 17/21] fixup

---
 app/services/idv/steps/ipp/ssn_step.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/services/idv/steps/ipp/ssn_step.rb b/app/services/idv/steps/ipp/ssn_step.rb
index 626bf4ea8ea..b6c9e3b8987 100644
--- a/app/services/idv/steps/ipp/ssn_step.rb
+++ b/app/services/idv/steps/ipp/ssn_step.rb
@@ -25,7 +25,7 @@ def form_submit
         end
 
         def updating_ssn
-          flow_session.dig(:pii_from_doc, :ssn).present?
+          flow_session.dig(:pii_from_user, :ssn).present?
         end
 
         def threatmetrix_session_id

From 0f6ebc5297aba92292410ee88952157c79abd16c Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Wed, 10 Aug 2022 11:49:06 -0400
Subject: [PATCH 18/21] changed function to generate_threatmetrix_session_id

---
 app/services/idv/steps/ipp/ssn_step.rb | 6 ++++--
 app/services/idv/steps/ssn_step.rb     | 8 +++++---
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/app/services/idv/steps/ipp/ssn_step.rb b/app/services/idv/steps/ipp/ssn_step.rb
index b6c9e3b8987..6f6bbc0ee09 100644
--- a/app/services/idv/steps/ipp/ssn_step.rb
+++ b/app/services/idv/steps/ipp/ssn_step.rb
@@ -7,7 +7,9 @@ class SsnStep < DocAuthBaseStep
         def call
           flow_session[:pii_from_user][:ssn] = flow_params[:ssn]
 
-          flow_session[:threatmetrix_session_id] = threatmetrix_session_id unless updating_ssn
+          unless updating_ssn
+            flow_session[:threatmetrix_session_id] = generate_threatmetrix_session_id
+          end
 
           idv_session.delete('applicant')
         end
@@ -28,7 +30,7 @@ def updating_ssn
           flow_session.dig(:pii_from_user, :ssn).present?
         end
 
-        def threatmetrix_session_id
+        def generate_threatmetrix_session_id
           return unless IdentityConfig.store.proofing_device_profiling_collecting_enabled
           SecureRandom.uuid
         end
diff --git a/app/services/idv/steps/ssn_step.rb b/app/services/idv/steps/ssn_step.rb
index aa718a02808..a56dbb96d4a 100644
--- a/app/services/idv/steps/ssn_step.rb
+++ b/app/services/idv/steps/ssn_step.rb
@@ -8,7 +8,9 @@ def call
 
         flow_session[:pii_from_doc][:ssn] = flow_params[:ssn]
 
-        flow_session[:threatmetrix_session_id] = threatmetrix_session_id unless updating_ssn
+        unless updating_ssn
+          flow_session[:threatmetrix_session_id] = generate_threatmetrix_session_id
+        end
 
         idv_session.delete('applicant')
       end
@@ -38,8 +40,8 @@ def invalid_state_response
         FormResponse.new(success: false)
       end
 
-      def threatmetrix_session_id
-        return nil if !IdentityConfig.store.proofing_device_profiling_collecting_enabled
+      def generate_threatmetrix_session_id
+        return unless IdentityConfig.store.proofing_device_profiling_collecting_enabled
         SecureRandom.uuid
       end
     end

From d09f7753c5655f411e0be8bd6e615d05b4d36841 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Wed, 10 Aug 2022 14:04:31 -0400
Subject: [PATCH 19/21] add tests for ssn_step

---
 spec/services/idv/steps/ssn_step_spec.rb | 35 +++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/spec/services/idv/steps/ssn_step_spec.rb b/spec/services/idv/steps/ssn_step_spec.rb
index 218dc44fcdf..73137d7eb5c 100644
--- a/spec/services/idv/steps/ssn_step_spec.rb
+++ b/spec/services/idv/steps/ssn_step_spec.rb
@@ -39,7 +39,10 @@
 
   let(:flow) do
     Idv::Flows::DocAuthFlow.new(controller, {}, 'idv/doc_auth').tap do |flow|
-      flow.flow_session = { pii_from_doc: pii_from_doc }
+      flow.flow_session = {
+        pii_from_doc: pii_from_doc,
+        threatmetrix_session_id: threatmetrix_session_id,
+      }
     end
   end
 
@@ -47,6 +50,11 @@
     Idv::Steps::SsnStep.new(flow)
   end
 
+  def threatmetrix_session_id
+    return unless IdentityConfig.store.proofing_device_profiling_collecting_enabled
+    session_id
+  end
+
   describe '#call' do
     context 'with valid ssn' do
       let(:ssn) { Idp::Constants::MOCK_IDV_APPLICANT_WITH_SSN[:ssn] }
@@ -67,6 +75,31 @@
           expect(session[:idv]['applicant']).to be_blank
         end
       end
+
+      context 'with proofing device profiling collecting enabled' do
+        let(:session_id) { 'ABCD-1234' }
+
+        it 'adds a session id to flow session' do
+          allow(IdentityConfig.store).
+            to receive(:proofing_device_profiling_collecting_enabled).
+            and_return(true)
+          step.call
+
+          expect(flow.flow_session[:threatmetrix_session_id]).to eq(threatmetrix_session_id)
+        end
+      end
+
+      context 'with proofing device profiling collecting disabled' do
+        let(:session_id) { 'ABCD-1234' }
+
+        it 'does not add a session id to flow session' do
+          allow(IdentityConfig.store).
+            to receive(:proofing_device_profiling_collecting_enabled).
+            and_return(false)
+          step.call
+          expect(flow.flow_session[:threatmetrix_session_id]).to eq(nil)
+        end
+      end
     end
 
     context 'when pii_from_doc is not present' do

From 13b089e9f260f20be98676e39c880d5adb13cb66 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 11 Aug 2022 15:26:00 -0400
Subject: [PATCH 20/21] tests for ipp ssn_step

---
 spec/services/idv/steps/ipp/ssn_step_spec.rb | 21 +++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/spec/services/idv/steps/ipp/ssn_step_spec.rb b/spec/services/idv/steps/ipp/ssn_step_spec.rb
index 6cff2b2acc9..2863e82fd4b 100644
--- a/spec/services/idv/steps/ipp/ssn_step_spec.rb
+++ b/spec/services/idv/steps/ipp/ssn_step_spec.rb
@@ -6,6 +6,7 @@
   let(:session) { { sp: { issuer: service_provider.issuer } } }
   let(:user) { build(:user) }
   let(:service_provider) { create(:service_provider) }
+  let(:threatmetrix_session_id) { nil }
   let(:controller) do
     instance_double(
       'controller',
@@ -16,7 +17,12 @@
   end
 
   let(:flow) do
-    Idv::Flows::InPersonFlow.new(controller, {}, 'idv/in_person')
+    Idv::Flows::InPersonFlow.new(controller, {}, 'idv/in_person').tap do |flow|
+      flow.flow_session = {
+        pii_from_user: {},
+        threatmetrix_session_id: threatmetrix_session_id,
+      }
+    end
   end
 
   subject(:step) do
@@ -39,5 +45,18 @@
         expect(session[:idv]['applicant']).to be_blank
       end
     end
+
+    context 'with proofing device profiling collecting enabled' do
+      let(:threatmetrix_session_id) { 'ABCD-1234' }
+
+      it 'adds a session id to flow session' do
+        allow(IdentityConfig.store).
+          to receive(:proofing_device_profiling_collecting_enabled).
+          and_return(true)
+        step.call
+
+        expect(flow.flow_session[:threatmetrix_session_id]).to eq(threatmetrix_session_id)
+      end
+    end
   end
 end

From 5ced292041daa30d11b33c7be9925767561b9823 Mon Sep 17 00:00:00 2001
From: Alex Bradley <alexander.bradley@gsa.gov>
Date: Thu, 11 Aug 2022 18:30:20 -0400
Subject: [PATCH 21/21] fixed logic and tests

---
 app/services/idv/steps/ipp/ssn_step.rb       |  3 +--
 app/services/idv/steps/ssn_step.rb           |  3 +--
 spec/services/idv/steps/ipp/ssn_step_spec.rb | 15 +++++++++----
 spec/services/idv/steps/ssn_step_spec.rb     | 22 ++++++++++----------
 4 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/app/services/idv/steps/ipp/ssn_step.rb b/app/services/idv/steps/ipp/ssn_step.rb
index 6f6bbc0ee09..53a8b5b995f 100644
--- a/app/services/idv/steps/ipp/ssn_step.rb
+++ b/app/services/idv/steps/ipp/ssn_step.rb
@@ -5,11 +5,10 @@ class SsnStep < DocAuthBaseStep
         STEP_INDICATOR_STEP = :verify_info
 
         def call
-          flow_session[:pii_from_user][:ssn] = flow_params[:ssn]
-
           unless updating_ssn
             flow_session[:threatmetrix_session_id] = generate_threatmetrix_session_id
           end
+          flow_session[:pii_from_user][:ssn] = flow_params[:ssn]
 
           idv_session.delete('applicant')
         end
diff --git a/app/services/idv/steps/ssn_step.rb b/app/services/idv/steps/ssn_step.rb
index a56dbb96d4a..57fb9b6c2e2 100644
--- a/app/services/idv/steps/ssn_step.rb
+++ b/app/services/idv/steps/ssn_step.rb
@@ -6,11 +6,10 @@ class SsnStep < DocAuthBaseStep
       def call
         return invalid_state_response if invalid_state?
 
-        flow_session[:pii_from_doc][:ssn] = flow_params[:ssn]
-
         unless updating_ssn
           flow_session[:threatmetrix_session_id] = generate_threatmetrix_session_id
         end
+        flow_session[:pii_from_doc][:ssn] = flow_params[:ssn]
 
         idv_session.delete('applicant')
       end
diff --git a/spec/services/idv/steps/ipp/ssn_step_spec.rb b/spec/services/idv/steps/ipp/ssn_step_spec.rb
index 2863e82fd4b..0a3f430e5af 100644
--- a/spec/services/idv/steps/ipp/ssn_step_spec.rb
+++ b/spec/services/idv/steps/ipp/ssn_step_spec.rb
@@ -20,7 +20,6 @@
     Idv::Flows::InPersonFlow.new(controller, {}, 'idv/in_person').tap do |flow|
       flow.flow_session = {
         pii_from_user: {},
-        threatmetrix_session_id: threatmetrix_session_id,
       }
     end
   end
@@ -47,15 +46,23 @@
     end
 
     context 'with proofing device profiling collecting enabled' do
-      let(:threatmetrix_session_id) { 'ABCD-1234' }
-
       it 'adds a session id to flow session' do
         allow(IdentityConfig.store).
           to receive(:proofing_device_profiling_collecting_enabled).
           and_return(true)
         step.call
 
-        expect(flow.flow_session[:threatmetrix_session_id]).to eq(threatmetrix_session_id)
+        expect(flow.flow_session[:threatmetrix_session_id]).to_not eq(nil)
+      end
+
+      it 'does not change threatmetrix_session_id when updating ssn' do
+        allow(IdentityConfig.store).
+          to receive(:proofing_device_profiling_collecting_enabled).
+          and_return(true)
+        step.call
+        session_id = flow.flow_session[:threatmetrix_session_id]
+        step.call
+        expect(flow.flow_session[:threatmetrix_session_id]).to eq(session_id)
       end
     end
   end
diff --git a/spec/services/idv/steps/ssn_step_spec.rb b/spec/services/idv/steps/ssn_step_spec.rb
index 73137d7eb5c..9252ccee7fb 100644
--- a/spec/services/idv/steps/ssn_step_spec.rb
+++ b/spec/services/idv/steps/ssn_step_spec.rb
@@ -41,7 +41,6 @@
     Idv::Flows::DocAuthFlow.new(controller, {}, 'idv/doc_auth').tap do |flow|
       flow.flow_session = {
         pii_from_doc: pii_from_doc,
-        threatmetrix_session_id: threatmetrix_session_id,
       }
     end
   end
@@ -50,11 +49,6 @@
     Idv::Steps::SsnStep.new(flow)
   end
 
-  def threatmetrix_session_id
-    return unless IdentityConfig.store.proofing_device_profiling_collecting_enabled
-    session_id
-  end
-
   describe '#call' do
     context 'with valid ssn' do
       let(:ssn) { Idp::Constants::MOCK_IDV_APPLICANT_WITH_SSN[:ssn] }
@@ -77,21 +71,27 @@ def threatmetrix_session_id
       end
 
       context 'with proofing device profiling collecting enabled' do
-        let(:session_id) { 'ABCD-1234' }
-
         it 'adds a session id to flow session' do
           allow(IdentityConfig.store).
             to receive(:proofing_device_profiling_collecting_enabled).
             and_return(true)
           step.call
 
-          expect(flow.flow_session[:threatmetrix_session_id]).to eq(threatmetrix_session_id)
+          expect(flow.flow_session[:threatmetrix_session_id]).to_not eq(nil)
+        end
+
+        it 'does not change threatmetrix_session_id when updating ssn' do
+          allow(IdentityConfig.store).
+            to receive(:proofing_device_profiling_collecting_enabled).
+            and_return(true)
+          step.call
+          session_id = flow.flow_session[:threatmetrix_session_id]
+          step.call
+          expect(flow.flow_session[:threatmetrix_session_id]).to eq(session_id)
         end
       end
 
       context 'with proofing device profiling collecting disabled' do
-        let(:session_id) { 'ABCD-1234' }
-
         it 'does not add a session id to flow session' do
           allow(IdentityConfig.store).
             to receive(:proofing_device_profiling_collecting_enabled).