LG-7014 Device Profiling on the SSN page

app/services/idv/steps/ssn_step.rb

@@ -7,6 +7,10 @@ def call
         return invalid_state_response if invalid_state?
 
         flow_session[:pii_from_doc][:ssn] = flow_params[:ssn]
+
+        if IdentityConfig.store.proofing_device_profiling_collecting_enabled
+          flow_session[:threatmetrix_session_id] = threatmetrix_session_id
+        end
       end
 
       def extra_view_variables
@@ -29,6 +33,11 @@ def invalid_state_response
         mark_step_incomplete(:document_capture)
         FormResponse.new(success: false)
       end
+
+      def threatmetrix_session_id
+        return nil if !IdentityConfig.store.proofing_device_profiling_collecting_enabled
+        SecureRandom.uuid
+      end
     end
   end
 end

app/views/idv/doc_auth/ssn.html.erb

@@ -1 +1 @@
-<%= render 'idv/shared/ssn', flow_session: flow_session, success_alert_enabled: !updating_ssn, updating_ssn: updating_ssn %>
+<%= render 'idv/shared/ssn', flow_session: flow_session, success_alert_enabled: !updating_ssn, updating_ssn: updating_ssn, threatmetrix_session_id: threatmetrix_session_id %>

app/views/idv/shared/_ssn.html.erb

@@ -28,6 +28,17 @@ locals:
   <%= new_window_link_to(t('doc_auth.instructions.learn_more'), MarketingSite.security_and_privacy_practices_url) %>
 </p>
 
+<% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
+  <% unless IdentityConfig.store.lexisnexis_threatmetrix_account_id.empty? || updating_ssn %>
+    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
+    </script>
+    <noscript>
+      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_account_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
+      </iframe>
+    </noscript>
+  <% end %>
+<% end %>
+
 <% if IdentityConfig.store.proofer_mock_fallback %>
   <div class="usa-alert usa-alert--info margin-bottom-4" role="status">
     <div class="usa-alert__body">

config/initializers/content_security_policy.rb

@@ -25,6 +25,10 @@
     IdentityConfig.store.asset_host.presence,
   ].compact
 
+  if IdentityConfig.store.proofing_device_profiling_collecting_enabled
+    script_src << 'h.online-metrix.net'
+  end
+
   script_src = [:self, :unsafe_eval] if !Rails.env.production?
 
   style_src = [:self, IdentityConfig.store.asset_host.presence].compact

spec/views/idv/shared/_ssn.html.erb_spec.rb

@@ -0,0 +1,119 @@
+require 'rails_helper'
+
+describe 'idv/shared/_ssn.html.erb' do
+  include Devise::Test::ControllerHelpers
+
+  let(:proofing_device_profiling_collecting_enabled) { nil }
+  let(:lexisnexis_threatmetrix_account_id) { 'test_org_id' }
+  let(:session_id) { 'ABCD-1234' }
+  let(:updating_ssn) { false }
+  let(:js_domain) { 'h.online-metrix.net' }
+
+  let(:tags_js_url) {
+    "https://#{js_domain}/fp/tags.js?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
+  }
+
+  let(:tags_iframe_url) {
+    "https://#{js_domain}/fp/tags?org_id=#{lexisnexis_threatmetrix_account_id}&session_id=#{session_id}"
+  }
+
+  let(:script_tag_rendered) {
+    expect(rendered).to have_css("script[src='#{tags_js_url}']", visible: false)
+  }
+
+  let(:noscript_tag_rendered) {
+    expect(rendered).to have_css("noscript iframe[src='#{tags_iframe_url}']", visible: false)
+  }
+
+  let(:session_id_input_rendered) {
+    expect(rendered).
+      to have_css(
+        "input[type=hidden][name='doc_auth[threatmetrix_session_id]'][value='#{session_id}']",
+        visible: false,
+      )
+  }
+
+  let(:script_tag_not_rendered) {
+    expect(rendered).not_to have_css("script[src*='#{js_domain}']", visible: false)
+  }
+
+  let(:noscript_tag_not_rendered) {
+    expect(rendered).not_to have_css("noscript iframe[src*='#{js_domain}']", visible: false)
+  }
+
+  let(:session_id_input_not_rendered) {
+    expect(rendered).
+      not_to have_css('input[name="doc_auth[threatmetrix_session_id]"]', visible: false)
+  }
+
+  before :each do
+    allow(view).to receive(:url_for).and_return('https://example.com/')
+
+    allow(IdentityConfig.store).
+      to receive(:proofing_device_profiling_collecting_enabled).
+      and_return(proofing_device_profiling_collecting_enabled)
+    allow(IdentityConfig.store).
+      to receive(:lexisnexis_threatmetrix_account_id).and_return(lexisnexis_threatmetrix_account_id)
+
+    render partial: 'idv/shared/ssn', locals: {
+      flow_session: {
+        threatmetrix_session_id: session_id,
+      },
+      success_alert_enabled: false,
+      updating_ssn: updating_ssn,
+    }
+  end
+
+  context 'when threatmetrix collection enabled' do
+    let(:proofing_device_profiling_collecting_enabled) { true }
+
+    context 'and org id specified' do
+      context 'and entering ssn for the first time' do
+        describe '<script> tag' do
+          it 'is rendered' do
+            script_tag_rendered
+          end
+        end
+
+        describe '<noscript> tag' do
+          it 'is rendered' do
+            noscript_tag_rendered
+          end
+        end
+      end
+
+      context 'updating ssn already entered' do
+        let(:updating_ssn) { true }
+
+        it 'does not render <script> tag' do
+          script_tag_not_rendered
+        end
+        it 'does not render <noscript> tag' do
+          noscript_tag_not_rendered
+        end
+      end
+    end
+
+    context 'org id not specified' do
+      let(:lexisnexis_threatmetrix_account_id) { '' }
+
+      it 'does not render <script> tag' do
+        script_tag_not_rendered
+      end
+      it 'does not render <noscript> tag' do
+        noscript_tag_not_rendered
+      end
+    end
+  end
+
+  context 'threatmetrix collection disabled' do
+    let(:proofing_device_profiling_collecting_enabled) { false }
+
+    it 'does not render <script> tag' do
+      script_tag_not_rendered
+    end
+    it 'does not render <noscript> tag' do
+      noscript_tag_not_rendered
+    end
+  end
+end